ver0759 - The processWithdrawals function may cause users can't withdraw their funds forever

[sherlock-admin]

ver0759

medium

The processWithdrawals function may cause users can't withdraw their funds forever

Summary

The processWithdrawals function in VUSD.sol doesn't handle if call function failed, this will cause users can't withdraw their funds forever.

Vulnerability Detail

The processWithdrawals function will uses the withdrawals to transfer value to users with call:

VUSD.sol
    /**
     * @notice Process withdrawals in the queue. Sends gas token to the user.
    */
    function processWithdrawals() external override whenNotPaused nonReentrant {
        uint reserve = address(this).balance;
        require(reserve >= withdrawals[start].amount, 'Cannot process withdrawals at this time: Not enough balance');
        uint i = start;
        while (i < withdrawals.length && (i - start) < maxWithdrawalProcesses) {
            Withdrawal memory withdrawal = withdrawals[i];
            if (reserve < withdrawal.amount) {
                break;
            }

            (bool success, bytes memory data) = withdrawal.usr.call{value: withdrawal.amount}(""); // <--here
            if (success) {
                reserve -= withdrawal.amount;
            } else {
                emit WithdrawalFailed(withdrawal.usr, withdrawal.amount, data);
            }
            i += 1;
        }
        // re-entracy not possible, hence can update `start` at the end
        start = i;
    }

But if call failed, it will skip this withdrawal and continue, last update start. And the next call to processWithdrawals won't handle the failed withdrawal. This will cause users to never be able to withdraw their funds.

Impact

Users can't withdraw their funds forever.

Code Snippet

https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/main/hubble-protocol/contracts/VUSD.sol#L65-L85

Tool used

Manual Review

Recommendation

Change the logic of processWithdrawals, starting from the head of withdrawals every time, when the call is successful, delete the current withdrawal from the withdrawals. When the call fails, the withdrawal is kept and a new round of attempts is made on the next call of the processWithdrawals function.

Duplicate of #162