From 59895fbb1bdceb26bb3a3d6da523848783108f20 Mon Sep 17 00:00:00 2001 From: Jeff Wu Date: Tue, 13 Aug 2024 09:29:32 -0700 Subject: [PATCH] fix: sherlock-audit/2024-06-leveraged-vaults-judging#87 --- contracts/vaults/staking/protocols/Kelp.sol | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/contracts/vaults/staking/protocols/Kelp.sol b/contracts/vaults/staking/protocols/Kelp.sol index cff69d70..6cb81263 100644 --- a/contracts/vaults/staking/protocols/Kelp.sol +++ b/contracts/vaults/staking/protocols/Kelp.sol @@ -47,10 +47,13 @@ contract KelpCooldownHolder is ClonedCoolDownHolder { } function _finalizeCooldown() internal override returns (uint256 tokensClaimed, bool finalized) { - (/* */, /* */, /* */, uint256 userWithdrawalRequestNonce) = WithdrawManager.getUserWithdrawalRequest(Deployments.ALT_ETH_ADDRESS, address(this), 0); + (/* */, /* */, uint256 userWithdrawalStartBlock, uint256 userWithdrawalRequestNonce) = WithdrawManager.getUserWithdrawalRequest(Deployments.ALT_ETH_ADDRESS, address(this), 0); uint256 nextNonce = WithdrawManager.nextLockedNonce(Deployments.ALT_ETH_ADDRESS); - // Will revert when nextLockedNonce == userWithdrawalRequestNonce, so this must be strictly less than - if (nextNonce < userWithdrawalRequestNonce) { + // These two requirements are checked in the WithdrawManager. + if ( + nextNonce < userWithdrawalRequestNonce || + block.number < userWithdrawalStartBlock + WithdrawManager.withdrawalDelayBlocks() + ) { return (0, false); }