Skip to content

Conversation

seongyun-ko
Copy link
Contributor

@seongyun-ko seongyun-ko commented Aug 27, 2025

Note

Adds a weETH withdrawal adapter (incl. permit flow) and enforces an admin-configurable max withdrawal amount in WithdrawRequestNFT.

  • Contracts:
    • src/WeETHWithdrawAdapter.sol (new):
      • Allows withdrawals using weETH by unwrapping to eETH and creating requests via LiquidityPool.
      • Supports gasless approvals via requestWithdrawWithPermit.
      • UUPS upgradeable, pausable via RoleRegistry, emits pause events; exposes getImplementation.
    • src/interfaces/IWeETHWithdrawAdapter.sol (new interface):
      • Defines requestWithdraw, requestWithdrawWithPermit (with PermitInput), getEETHByWeETH, and WithdrawRequested event.
  • WithdrawRequestNFT:
    • Adds maxWithdrawalAmount with setMaxWithdrawalAmount (admin-only).
    • Validates requestWithdraw to revert with TooLargeWithdrawalAmount when exceeding the cap.

Written by Cursor Bugbot for commit 63ee206. This will update automatically on new commits. Configure here.

@seongyun-ko seongyun-ko changed the title add a simple adapter contract to support withdrawal from weETH an adapter contract to support withdrawal from weETH Oct 6, 2025
@seongyun-ko seongyun-ko requested a review from solipsis October 6, 2025 15:20
solipsis
solipsis previously approved these changes Oct 6, 2025
_requireNotPaused();
_;
}
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Missing Conversion Function Causes Compilation Errors

The WeETHWithdrawAdapter contract implements IWeETHWithdrawAdapter but is missing the getEETHByWeETH function declared in the interface. This causes compilation errors and leaves a gap in the public interface, as users might expect this function for conversion rate calculations.

Fix in Cursor Fix in Web

uint256 eETHAmount = weETH.unwrap(weETHAmount);

// Approve eETH to be spent by LiquidityPool
IERC20(address(eETH)).safeApprove(address(liquidityPool), eETHAmount);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Non-Zero Allowance Blocks Safe Approve

The safeApprove call for eETH to the liquidityPool in requestWithdraw can revert if an existing allowance is not zero. This behavior, inherent to SafeERC20.safeApprove, causes subsequent calls to requestWithdraw to fail.

Fix in Cursor Fix in Web

uint256 requestId = nextRequestId++;
uint32 feeGwei = uint32(fee / 1 gwei);

if(amountOfEEth > maxWithdrawalAmount) revert TooLargeWithdrawalAmount();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Withdrawal Functionality Initially Disabled

The maxWithdrawalAmount variable defaults to 0 and lacks initialization. This blocks all withdrawal requests in requestWithdraw immediately after deployment, leading to a denial of service until an admin sets a non-zero value.

Fix in Cursor Fix in Web

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants