The beneficiaryWithdrawable Function Can Be Called by Anyone
The `beneficiaryWithdrawable` function is supposed to be called by the Agent when a beneficiary is trying to withdraw funds:\\n```\\nfunction beneficiaryWithdrawable(\\n address recipient,\\n address sender,\\n uint256 agentID,\\n uint256 proposedAmount\\n) external returns (\\n uint256 amount\\n) {\\n AgentBeneficiary memory beneficiary = \\_agentBeneficiaries[agentID];\\n address benneficiaryAddress = beneficiary.active.beneficiary;\\n // If the sender is not the owner of the Agent or the beneficiary, revert\\n if(\\n !(benneficiaryAddress == sender || (IAuth(msg.sender).owner() == sender && recipient == benneficiaryAddress) )) {\\n revert Unauthorized();\\n }\\n (\\n beneficiary,\\n amount\\n ) = beneficiary.withdraw(proposedAmount);\\n // update the beneficiary in storage\\n \\_agentBeneficiaries[agentID] = beneficiary;\\n}\\n```\\n\\nThis function reduces the quota that is supposed to be transferred during the `withdraw` call:\\n```\\n sendAmount = agentPolice.beneficiaryWithdrawable(receiver, msg.sender, id, sendAmount);\\n}\\nelse if (msg.sender != owner()) {\\n revert Unauthorized();\\n}\\n\\n// unwrap any wfil needed to withdraw\\n\\_poolFundsInFIL(sendAmount);\\n// transfer funds\\npayable(receiver).sendValue(sendAmount);\\n```\\n\\nThe issue is that anyone can call this function directly, and the quota will be reduced without funds being transferred.
Ensure only the Agent can call this function.
```\\nfunction beneficiaryWithdrawable(\\n address recipient,\\n address sender,\\n uint256 agentID,\\n uint256 proposedAmount\\n) external returns (\\n uint256 amount\\n) {\\n AgentBeneficiary memory beneficiary = \\_agentBeneficiaries[agentID];\\n address benneficiaryAddress = beneficiary.active.beneficiary;\\n // If the sender is not the owner of the Agent or the beneficiary, revert\\n if(\\n !(benneficiaryAddress == sender || (IAuth(msg.sender).owner() == sender && recipient == benneficiaryAddress) )) {\\n revert Unauthorized();\\n }\\n (\\n beneficiary,\\n amount\\n ) = beneficiary.withdraw(proposedAmount);\\n // update the beneficiary in storage\\n \\_agentBeneficiaries[agentID] = beneficiary;\\n}\\n```\\n