fix: added minEETHShares to WeETH withdraw request (DEV-1228)

[TheMj0ln1r]

Summary by CodeRabbit

Release Notes

• New Features

  • Enhanced withdrawal requests with minimum share validation to protect against unexpected conversion rates.

• Tests

  • Updated test suite to cover the new validation mechanism across multiple scenarios.

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added.

Updated Contracts

• MainnetController.sol: The smart contract update requires a minimum EETH share amount for withdrawals, adding a new parameter to enhance withdrawal conditions.
• WEETHLib.sol: Added sharesForAmount function to liquidity pool and minEETHShares requirement to protect against slippage in conversions.

---

🔗 Commit Hash: c0e4087

[notion-workspace]

Missing slippage protection on weETH withdrawal request

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR adds slippage protection to weETH withdrawal requests by introducing a minEETHShares parameter to the withdrawal function. A new sharesForAmount view function is added to the liquidity pool interface, and validation logic ensures the conversion meets the minimum share requirement.

Changes

Cohort / File(s)	Summary
Core Withdrawal Logic src/MainnetController.sol, src/libraries/WEETHLib.sol	Updated requestWithdrawFromWeETH and WEETHLib.requestWithdraw signatures to accept minEETHShares parameter. Added sharesForAmount view function to ILiquidityPoolLike interface and implemented validation check to enforce minimum share constraint during eETH conversions.
Test Updates test/mainnet-fork/weETH.t.sol	Added _getMinEETHShares helper function and updated all requestWithdrawFromWeETH calls to pass the new minEETHShares parameter. Test cases now compute and validate slippage protection across multiple scenarios including reentrancy and rate-limit boundary tests.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• [DEV-1041] : Add weETH integration #215: Directly modifies MainnetController.requestWithdrawFromWeETH and WEETHLib.requestWithdraw signatures, extending call parameters to include slippage protection.
• feat: Add minOutShares to weETH (DEV-1121) #223: Implements similar slippage-protection pattern for deposit operations, introducing sharesForAmount interface method and parameter validation logic.

Suggested reviewers

• deluca-mike
• lucas-manuel

Poem

🐰 A rabbit hops through share amounts so fine,
Protecting slips with boundaries divine,
Each withdrawal now has guards in place,
Minimum shares ensure we keep the pace! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly describes the main change: adding minEETHShares parameter to the WeETH withdraw request function, which is the primary focus across all modified files.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dev-1228-audit-fix

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[octane-security-app]

Overview

Vulnerabilities found:	5

Warnings found:	1

---

🔗 Commit Hash: c0e4087
🛡️ Octane Dashboard: All vulnerabilities

[lucas-manuel]

Module should go after proxy and rateLimits and before shares

[github-actions]

Coverage after merging dev-1228-audit-fix into dev will be

99.30%

Coverage Report

File	Stmts	Branches	Funcs	Lines	Uncovered Lines
deploy
ControllerDeploy.sol	100%	100%	100%	100%
ForeignControllerInit.sol	100%	100%	100%	100%
MainnetControllerInit.sol	97.37%	93.33%	100%	100%	152, 90
src
ALMProxy.sol	100%	100%	100%	100%
ALMProxyFreezable.sol	100%	100%	100%	100%
ForeignController.sol	96.10%	89.66%	95.65%	98.04%	130–131, 131, 131, 556
MainnetController.sol	99.20%	100%	98.39%	99.25%	616–617
OTCBuffer.sol	92.31%	100%	83.33%	93.75%	55
RateLimitHelpers.sol	100%	100%	100%	100%
RateLimits.sol	100%	100%	100%	100%
WEETHModule.sol	93.18%	90%	85.71%	96.30%	65, 72
src/libraries
AaveLib.sol	100%	100%	100%	100%
ApproveLib.sol	100%	100%	100%	100%
CCTPLib.sol	100%	100%	100%	100%
CurveLib.sol	100%	100%	100%	100%
ERC4626Lib.sol	97.06%	90%	100%	100%	117
LayerZeroLib.sol	100%	100%	100%	100%
PSMLib.sol	100%	100%	100%	100%
UniswapV4Lib.sol	99.33%	95.65%	100%	100%	282
WEETHLib.sol	100%	100%	100%	100%