# DOS in the claimWithdraw function due to an incorrect check of the lastFinalizedRequestId in the EEtherAdapter.sol

EEtherAdapter.claimWithdraw used inverted comparison against lastFinalizedRequestId, permanently blocking claims and inflating totalQueueEth.

- Payout: Contest reward
- Severity: high
- Program: Napier Update
- Credited: Drynooo
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-napier-update-judging/issues/55
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** EEtherAdapter.sol claimWithdraw / EtherFi WithdrawRequestNFT
**Root cause:** Adapter reverts when _requestId < lastFinalizedRequestId, but EtherFi finalizes cumulatively (tokenId <= lastFinalizedRequestId), so any request older than the latest finalized one is permanently unclaimable.
**Steps:**
1. Observe EtherFi WithdrawRequestNFT increments nextRequestId per request and finalizeRequests sets lastFinalizedRequestId cumulatively.
2. Note claimWithdrawal in WithdrawRequestNFT requires tokenId <= lastFinalizedRequestId.
3. Read EEtherAdapter.claimWithdraw: `if (_requestId < ETHERFI_WITHDRAW_NFT.lastFinalizedRequestId()) revert RequestInQueue();`
4. Admin finalizes a later requestId; earlier requestId now satisfies _requestId < lastFinalizedRequestId and reverts forever.
5. totalQueueEth stays inflated since claim can never decrement it.
**How found:** Compared the adapter's boundary check against EtherFi's own claimWithdrawal require, spotting the inverted inequality and confirming with on-chain state (nextRequestId=19059, lastFinalizedRequestId=18833, many unclaimed finalized IDs).
**Insight:** When wrapping an external protocol's NFT/queue, mirror its exact boundary semantics (<= vs <) — off-by-one direction on a cumulative finalization counter bricks all older requests permanently.