Hexens Audit: Redundant parameter in withdraw function

[BeratOz01]

Description

PATH: contracts/EncryptedERC.sol#L541-L543

The withdraw function in EncryptedERC contract accepts _amount, _tokenId, proof, input, _balancePCT parameters.

Inside the function there is a check:

{
// _amount should match with the amount in the proof
if (_amount != input[15]) {
revert InvalidProof();
}
}
As the _amount and input[15] parameters are given by the user, the check is redundant, as the user can give only one of them.

Remediation

Remove the _amount parameter and the if condition, and take the amount value from the proof, also fix in the EERC SDK’s withdraw call.