withheld_amt calculation is done after minting frxETHToken tokens

Lines of code Vulnerability details Proof of concept The submit method in frxETHMinter.sol has the following code // Give the sender frxETH frxETHToken.mintermintrecipient, msg.value; // Track the amount of ETH that we are keeping uint256 withheldamt = 0; if withholdRatio != 0 withheldamt =...

recoverEther not updating currentWithheldETH breaks calculation of withheld amount for further deposits

Lines of code Vulnerability details The emergency exit function recoverEther allows the owner to retrieve the ETH in case an issue were to happen. The problem is that this function does not update currentWithheldETH. This means upon deposit starting again after the emergency recovery,...