# Unhandled request invalidation by the owner of Etherfi will lead to stuck debt Medium · Code4rena · NFT lending · 19th June, 2024 Finding M-04 of the BendDAO security review. - Protocol: https://www.benddao.xyz/ - Report: /reports/benddao - Codebase: https://github.com/0xsimao/2024-07-benddao/tree/117ef61967d4b318fc65170061c9577e674fffa1 - Source: https://code4rena.com/reports/2024-07-benddao --- The `owner` of Etherfi has the ability to invalidate withdrawal requests, which will DoS `YieldEthStakingEtherfi::protocolClaimWithdraw()` without ever repaying the debt. Additionally, Etherfi has a mechanism to manually claim the invalidated withdrawal, which will leave the withdraw request in a DoSed state in `YieldEthStakingEtherfi`. ### Proof of Concept `WithdrawRequestNFT::claimWithdraw()` from Etherfi [checks](https://github.com/etherfi-protocol/smart-contracts/blob/master/src/WithdrawRequestNFT.sol#L94) that the request is valid. The owner of `WithdrawRequestNFT` may [invalidate](https://github.com/etherfi-protocol/smart-contracts/blob/master/src/WithdrawRequestNFT.sol#L174) the request at any time and claim it for [itself](https://github.com/etherfi-protocol/smart-contracts/blob/master/src/WithdrawRequestNFT.sol#L135). Thus, as withdrawals in `YieldEthStakingEtherfi` can not be canceled and there is no way to handle invalidated withdrawals, the debt from the nft will never be repaid if the owner claims the nft for itself. If the owner validates the request later, there will still be a period of unknown duration during which it's not possible to repay the debt. ### Tools Used Vscode, Foundry ### Recommended Mitigation Steps Create a mechanism to handle invalidated withdrawals or withdrawals that have been claimed by the owner. --- Related findings: - [It's possible for debt to be stuck in the LoopedVault when rebalancing from Aave to Morpho](https://0xsimao.com/findings/yieldoor-iii-debt-stuck-aave-morpho): Yieldoor LoopedVault Update