Submitted by adriro (1, 2) and also d3e4
Original Issue: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/62
Lines of Code: https://github.com/code-423n4/2023-09-asymmetry/blob/6b4867491350f8327d0ac4f496f263642cf3c1be/contracts/AfEth.sol#L148-L169
The sponsor has provided a detailed response in the following comment: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/62#issuecomment-1760305328
In summary their analysis is:
As the sponsor comments:
However, the accepted risk is also justified by the introduction of a minimum delay in the withdrawal process:
Given the error with the withdrawal delay in VotiumStrategy, detailed in VotiumStrategy withdrawal can still be executed with minimal delay, which still offers the possibility of depositing into the protocol with minimal exposure to CVX, the attack is still feasible and can be performed under the right circumstances. The assessment is that the issue is still present and it has not been mitigated.
