Attacker can freeze deposits and withdrawals indefinitely by submitting a bad withdrawal
Users request to queue a withdrawal using the function below in Vault.\\n```\\n        function addWithdrawRequest(uint256 _amountMLP, address _token) external {\\n            require(isAcceptingToken(_token), "ERROR: Invalid token");\\n                require(_amountMLP != 0, "ERROR: Invalid amount");\\n        \\n        address _withdrawer = msg.sender;\\n        // Get the pending buffer and staged buffer.\\n             RequestBuffer storage _pendingBuffer = _requests(false);\\n             RequestBuffer storage _stagedBuffer = _requests(true);\\n        // Check if the withdrawer have enough balance to withdraw.\\n        uint256 _bookedAmountMLP =  _stagedBuffer.withdrawAmountPerUser[_withdrawer] + \\n       _pendingBuffer.withdrawAmountPerUser[_withdrawer];\\n            require(_bookedAmountMLP + _amountMLP <= \\n                MozaicLP(mozLP).balanceOf(_withdrawer), "Withdraw amount > amount  MLP");\\n        …\\n        emit WithdrawRequestAdded(_withdrawer, _token, chainId, _amountMLP);\\n        }\\n```\\n\\nNotice that the function only validates that the user has a sufficient LP token balance to withdraw at the moment of execution. After it is queued up, a user can move their tokens to another wallet. Later in `_settleRequests()`, the Vault will attempt to burn user's tokens:\\n```\\n                // Burn moazic LP token.\\n            MozaicLP(mozLP).burn(request.user, _mlpToBurn);\\n```\\n\\nThis would revert and block any other settlements from occurring. Therefore, users can block the entire settlement process by requesting a tiny withdrawal amount in every epoch and moving funds to another wallet.
Vault should take custody of user's LP tokens when they request withdrawals. If the entire withdrawal cannot be satisfied, it can refund some tokens back to the user.
```\\n        function addWithdrawRequest(uint256 _amountMLP, address _token) external {\\n            require(isAcceptingToken(_token), "ERROR: Invalid token");\\n                require(_amountMLP != 0, "ERROR: Invalid amount");\\n        \\n        address _withdrawer = msg.sender;\\n        // Get the pending buffer and staged buffer.\\n             RequestBuffer storage _pendingBuffer = _requests(false);\\n             RequestBuffer storage _stagedBuffer = _requests(true);\\n        // Check if the withdrawer have enough balance to withdraw.\\n        uint256 _bookedAmountMLP =  _stagedBuffer.withdrawAmountPerUser[_withdrawer] + \\n       _pendingBuffer.withdrawAmountPerUser[_withdrawer];\\n            require(_bookedAmountMLP + _amountMLP <= \\n                MozaicLP(mozLP).balanceOf(_withdrawer), "Withdraw amount > amount  MLP");\\n        …\\n        emit WithdrawRequestAdded(_withdrawer, _token, chainId, _amountMLP);\\n        }\\n```\\n