Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies()

Description

Anyone who wants to withdraw from a batch via Batch:withdraw() can be frontrunned by an allocateToStrategies() call, which increases the cycle id, making the withdrawal revert.

This not only DoS users, but also places them at a loss if they want to withdraw, as they will likely receive shares worth less than their deposits at the moment the allocation happens.

Recommendation

Make strategyRouter:allocateToStrategies() permissioned so it becomes impossible for malicious users to perform the attack. Additionally, it's probably better to set some sort of fixed interval for the allocations to happen, so users have time to withdraw if they want to.

Status

Acknowledged