re-entrency possible on processWithdraw since external call is made before burning user's shares in Vault
re-entrency possible on processWithdraw since external call is made before burning user's shares in Vault\\n```\\n      if (self.withdrawCache.withdrawParams.token == address(self.WNT)) {\\n        self.WNT.withdraw(self.withdrawCache.tokensToUser);\\naudit transfer ETH and call        (bool success, ) = self.withdrawCache.user.call{value: address(this).balance}("");\\n        require(success, "Transfer failed.");\\n      } else {\\n        // Transfer requested withdraw asset to user\\n        IERC20(self.withdrawCache.withdrawParams.token).safeTransfer(\\n          self.withdrawCache.user,\\n          self.withdrawCache.tokensToUser\\n        );\\n      }\\n\\n      // Transfer any remaining tokenA/B that was unused (due to slippage) to user as well\\n      self.tokenA.safeTransfer(self.withdrawCache.user, self.tokenA.balanceOf(address(this)));\\n      self.tokenB.safeTransfer(self.withdrawCache.user, self.tokenB.balanceOf(address(this)));\\n\\n      // Burn user shares\\n burn is after      self.vault.burn(self.withdrawCache.user, self.withdrawCache.withdrawParams.shareAmt);\\n```\\n\\nhttps://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/strategy/gmx/GMXWithdraw.sol#L182-L197\\nSince the function is only accessible by keeper (likely a router), which from the example of the mockRouter, would bundle the withdraw and "afterWithdrawalExecution" together. However since the router is out-of-scope, and there is still a possible chance that the user can make use of the router to re-enter into the function (without re-entrency lock), and be able to drain more fund that he actually deserves. This is submitted as a medium risk.
burn user's share first, before executing external call at the end.
drain of user funds.
```\\n      if (self.withdrawCache.withdrawParams.token == address(self.WNT)) {\\n        self.WNT.withdraw(self.withdrawCache.tokensToUser);\\naudit transfer ETH and call        (bool success, ) = self.withdrawCache.user.call{value: address(this).balance}("");\\n        require(success, "Transfer failed.");\\n      } else {\\n        // Transfer requested withdraw asset to user\\n        IERC20(self.withdrawCache.withdrawParams.token).safeTransfer(\\n          self.withdrawCache.user,\\n          self.withdrawCache.tokensToUser\\n        );\\n      }\\n\\n      // Transfer any remaining tokenA/B that was unused (due to slippage) to user as well\\n      self.tokenA.safeTransfer(self.withdrawCache.user, self.tokenA.balanceOf(address(this)));\\n      self.tokenB.safeTransfer(self.withdrawCache.user, self.tokenB.balanceOf(address(this)));\\n\\n      // Burn user shares\\n burn is after      self.vault.burn(self.withdrawCache.user, self.withdrawCache.withdrawParams.shareAmt);\\n```\\n