Etherfi Withdrawal Request Gate - #320
Merged
Merged
Conversation
sparrowDom
requested review from
clement-ux and
naddison36
and removed request for
clement-ux
July 24, 2026 11:09
sparrowDom
commented
Jul 24, 2026
| /// @dev ETH arriving outside an adapter-initiated claim (e.g. a permissionless Ether.fi claim) is | ||
| /// rejected. Ether.fi reverts the entire claim, including the NFT burn, when this transfer fails. | ||
| receive() external payable { | ||
| if (!claimingEtherFi) { |
Member
Author
There was a problem hiding this comment.
@clement-ux is making a point that this check could be:
if (msg.sender == address(etherfiWithdrawalNFT) && !claimingEtherFi) {
There are pros/cons to it:
🟢 code change would allow sending ETH to adapter in case there was a shortfall
🔴 code change would allow a donation attack
Member
Author
There was a problem hiding this comment.
I lean towards not allowing for a donation attack and accounting for everything. In case we ever need to infuse the adapter/ARM with funds I would rather we make a deliberate function for it
Collaborator
There was a problem hiding this comment.
After some thought, I agree that we should keep the first implementation (msg.sender == address(etherfiWithdrawalNFT) && !claimingEtherFi).
Member
Author
There was a problem hiding this comment.
nit: you probably ment this by the first implementation:
if (!claimingEtherFi) {
shahthepro
previously approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gates
EtherFiAssetAdapter&WeETHAssetAdapterso an Ether.fi withdrawal NFT owned by the adapter can only be claimed through the adapter itself.Background
Ether.fi's
WithdrawRequestNFT.claimWithdraw(tokenId)is permissionless: anyone can claim a finalized withdrawal NFT, and the proceeds are sent to the NFT owner. In the multi-asset ARM the NFT is owned byEtherFiAssetAdapterorWeETHAssetAdapter, the ARM values the outstanding request once viapendingRedeemAssets, and the adapter'sredeem()wraps and sweeps its entire ETH/WETH balance to the ARM.Fix
A reentrancy-style flag marks the only legitimate window in which Ether.fi may pay this adapter, and
receive()rejects claim proceeds that arrive outside it