Protection sellers can bypass withdrawal delay mechanism and avoid losing funds when loans are defaulted by creating withdrawal request in each cycle
To prevent protection sellers from withdrawing fund immediately when protected lending pools are defaults, there is withdrawal delay mechanism, but it's possible to bypass it by creating withdraw request in each cycle by doing so user can withdraw in each cycle's open state. there is no penalty for users when they do this or there is no check to avoid this.\\nThis is `_requestWithdrawal()` code:\\n```\\n  function _requestWithdrawal(uint256 _sTokenAmount) internal {\\n    uint256 _sTokenBalance = balanceOf(msg.sender);\\n    if (_sTokenAmount > _sTokenBalance) {\\n      revert InsufficientSTokenBalance(msg.sender, _sTokenBalance);\\n    }\\n\\n    /// Get current cycle index for this pool\\n    uint256 _currentCycleIndex = poolCycleManager.getCurrentCycleIndex(\\n      address(this)\\n    );\\n\\n    /// Actual withdrawal is allowed in open period of cycle after next cycle\\n    /// For example: if request is made in at some time in cycle 1,\\n    /// then withdrawal is allowed in open period of cycle 3\\n    uint256 _withdrawalCycleIndex = _currentCycleIndex + 2;\\n\\n    WithdrawalCycleDetail storage withdrawalCycle = withdrawalCycleDetails[\\n      _withdrawalCycleIndex\\n    ];\\n\\n    /// Cache existing requested amount for the cycle for the sender\\n    uint256 _oldRequestAmount = withdrawalCycle.withdrawalRequests[msg.sender];\\n    withdrawalCycle.withdrawalRequests[msg.sender] = _sTokenAmount;\\n\\n    unchecked {\\n      /// Update total requested withdrawal amount for the cycle considering existing requested amount\\n      if (_oldRequestAmount > _sTokenAmount) {\\n        withdrawalCycle.totalSTokenRequested -= (_oldRequestAmount -\\n          _sTokenAmount);\\n      } else {\\n        withdrawalCycle.totalSTokenRequested += (_sTokenAmount -\\n          _oldRequestAmount);\\n      }\\n    }\\n\\n    emit WithdrawalRequested(msg.sender, _sTokenAmount, _withdrawalCycleIndex);\\n  }\\n```\\n\\nAs you can see it doesn't keep track of user current withdrawal requests and user can request withdrawal for all of his balance in each cycle and by doing so user can set `withdrawalCycleDetails[Each Cycle][User]` to user's sToken balance. and whenever user wants to withdraw he only need to wait until the end of the current cycle while he should have waited until next cycle end.
To avoid this code should keep track of user balance that is not in withdraw delay and user balance that are requested for withdraw. and to prevent users from requesting withdrawing and not doing it protocol should have some penalties for withdrawals, for example the waiting withdraw balance shouldn't get reward in waiting duration.
protection sellers can request withdraw in each cycle for their full sToken balance and code would allow them to withdraw in each cycle end time because code doesn't track how much of the balance of users is requested for withdrawals in the past.
```\\n  function _requestWithdrawal(uint256 _sTokenAmount) internal {\\n    uint256 _sTokenBalance = balanceOf(msg.sender);\\n    if (_sTokenAmount > _sTokenBalance) {\\n      revert InsufficientSTokenBalance(msg.sender, _sTokenBalance);\\n    }\\n\\n    /// Get current cycle index for this pool\\n    uint256 _currentCycleIndex = poolCycleManager.getCurrentCycleIndex(\\n      address(this)\\n    );\\n\\n    /// Actual withdrawal is allowed in open period of cycle after next cycle\\n    /// For example: if request is made in at some time in cycle 1,\\n    /// then withdrawal is allowed in open period of cycle 3\\n    uint256 _withdrawalCycleIndex = _currentCycleIndex + 2;\\n\\n    WithdrawalCycleDetail storage withdrawalCycle = withdrawalCycleDetails[\\n      _withdrawalCycleIndex\\n    ];\\n\\n    /// Cache existing requested amount for the cycle for the sender\\n    uint256 _oldRequestAmount = withdrawalCycle.withdrawalRequests[msg.sender];\\n    withdrawalCycle.withdrawalRequests[msg.sender] = _sTokenAmount;\\n\\n    unchecked {\\n      /// Update total requested withdrawal amount for the cycle considering existing requested amount\\n      if (_oldRequestAmount > _sTokenAmount) {\\n        withdrawalCycle.totalSTokenRequested -= (_oldRequestAmount -\\n          _sTokenAmount);\\n      } else {\\n        withdrawalCycle.totalSTokenRequested += (_sTokenAmount -\\n          _oldRequestAmount);\\n      }\\n    }\\n\\n    emit WithdrawalRequested(msg.sender, _sTokenAmount, _withdrawalCycleIndex);\\n  }\\n```\\n