Real Glossy Rhino
Medium
The withdrawOnBehalf function allows anyone to withdraw staked tokens on behalf of a user (_depositor) if they possess a valid _signature. However, the function lacks proper validation to restrict the caller (msg.sender) from initiating withdrawals unless they are authorized by the depositor. This creates a critical vulnerability as malicious actors can exploit valid signatures to withdraw funds from deposits without the user’s consent.
Anyone with access to a valid _signature can withdraw funds from deposits without the user’s consent.
Manual Review, Foundry
Only deposit.owner or deposit.claimer should be able to call withdrawOnBehalf