WithdrawQueue contract cannot claim EigenLayer ecosystem rewards

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Withdraw/WithdrawQueue.sol#L214

Vulnerability details

Impact

The WithdrawQueue is unable to claim airdrops accumulated from ezETH points, EigenLayer points, AVS points, etc.

Proof of Concept

When a user calls the withdraw function of WithdrawQueue to initiate a withdrawal, the user's ezETH will be transferred to the WithdrawQueue contract.

WithdrawQueue.sol#L206-L214

    function withdraw(uint256 _amount, address _assetOut) external nonReentrant {
        // ...
        // transfer ezETH tokens to this address
        IERC20(address(ezETH)).safeTransferFrom(msg.sender, address(this), _amount);

This means that the WithdrawQueue contract starts holding ezETH and begins accumulating points, including ezETH points, EigenLayer points, AVS points, as well as potential future project incentives, and so on.

However, WithdrawQueue lacks a flexible function to claim the corresponding token airdrop rewards when the aforementioned points mature.

Tools Used

Manual Analysis

Recommended Mitigation Steps

Add a function that allows only the WithdrawQueue admin to call it, enabling flexible invocation of arbitrary contracts. For example:

function execute(address _to, uint256 _value, bytes memory _data) external onlyWithdrawQueueAdmin {
    (bool success, ) = payable(_to).call{ value: _value }(_data);
    if (!success) revert("Execution failed");
}

Assessed type

Other

[jatinj615]

airdrops and points are accumulated offchain.

[alcueca]

@jatinj615, the warden is stating that if the WithdrawQueue will hold tokens that might make it accumulate rewards, and often these rewards need to be claimed by the address accumulating them.

Tbh, this is QA

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a

[jatinj615]

No, that is a wrong assumption as we have already proven with both renzo airdrop and EigenLayer airdrop that we exclude our contracts from accumulating any points. It has to be indexed offchain.

[c4-judge]

alcueca marked the issue as grade-b