# SFrxETHAdapter redemptionQueue waiting period can DOS adapter functions

SFrxETHAdapter's 15-day Frax redemption queue delay lets net redemptions drain bufferEth to zero, DoSing prefundedRedeem and stalling deposits.

- Payout: Contest reward
- Severity: medium
- Program: Napier
- Credited: falconhoof
- Disclosed: 2024-01-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/120
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-13
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** SFrxETHAdapter / BaseLSTAdapter bufferEth and FraxEtherRedemptionQueue
**Root cause:** Withdrawals from FraxEtherRedemptionQueue take ~15 days (queueLengthSecs), so requestWithdrawal cannot refill bufferEth quickly; sustained net redemptions drain bufferEth to 0.
**Steps:**
1. Observe redemptionQueueState.queueLengthSecs = 1_296_000 (~15 days) on FraxEtherRedemptionQueue.
2. Start with 100 wETH: bufferEth=10, sFrxETH=90.
3. Net redemption of 5 wETH drops bufferEth; rebalancer calls requestWithdrawal(4.5) but funds unavailable for 15 days.
4. During wait, continued redemptions push bufferEth toward 0.
5. prefundedRedeem reverts with InsufficientBuffer once assets > bufferEth; prefundedDeposit stalls unstaked with no yield.
**How found:** Code review of BaseLSTAdapter buffer logic combined with reading FraxEtherRedemptionQueue's on-chain queueLengthSecs (~15 days), noticing requestWithdrawal cannot restore bufferEth within that window.
**Exploitation:** Attacker/user performs large net redemptions against the adapter; since bufferEth cannot be replenished within the 15-day queue window, prefundedRedeem reverts for all users and deposits sit unstaked earning no yield.
**Escalation:** Repeated redemptions during the wait window force additional requestWithdrawal calls and can fully zero the buffer, locking user withdrawals.
**Insight:** When an adapter's buffer refill depends on an external protocol's withdrawal queue, compare the queue delay against expected redemption velocity; a slow refill path turns normal user redemptions into a buffer-drain DoS.