Unhandled request invalidation by the owner of Etherfi will lead to stuck debt

The owner of Etherfi has the ability to invalidate withdrawal requests, which will DoS YieldEthStakingEtherfi::protocolClaimWithdraw() without ever repaying the debt. Additionally, Etherfi has a mechanism to manually claim the invalidated withdrawal, which will leave the withdraw request in a DoSed state in YieldEthStakingEtherfi.

Proof of Concept

WithdrawRequestNFT::claimWithdraw() from Etherfi checks that the request is valid. The owner of WithdrawRequestNFT may invalidate the request at any time and claim it for itself.

Thus, as withdrawals in YieldEthStakingEtherfi can not be canceled and there is no way to handle invalidated withdrawals, the debt from the nft will never be repaid if the owner claims the nft for itself. If the owner validates the request later, there will still be a period of unknown duration during which it's not possible to repay the debt.

Tools Used

Vscode, Foundry

Recommended Mitigation Steps

Create a mechanism to handle invalidated withdrawals or withdrawals that have been claimed by the owner.