HIGH severity: Instant withdrawals in priority pool can result in loss of funds for StakingProxy contract. **Description:** When instant withdrawals are enabled in the priority pool, `staker` can permanently lose funds when withdrawing through the `StakingProxy` contract. The issue occurs because the withdrawn amount is not properly updated in the priority pool's `_withdraw` function during instant...

Vulnerable code:
function _withdraw(
    address _account,
    uint256 _amount,
    bool _shouldQueueWithdrawal,
    bool _shouldRevertOnZero,
    bytes[] memory _data
) internal returns (uint256) {
    if (poolStatus == PoolStatus.CLOSED) revert WithdrawalsDisabled();

    uint256 toWithdraw = _amount;
    uint256 withdrawn;
    uint256 queued;

    if (totalQueued != 0) {
        uint256 toWithdrawFromQueue = toWithdraw <= totalQueued ? toWithdraw : totalQueued;

        totalQueued -= toWithdrawFromQueue;
        depositsSinceLastUpdate += toWithdrawFromQueue;
        sharesSinceLastUpdate += stakingPool.getSharesByStake(toWithdrawFromQueue);
        toWithdraw -= toWithdrawFromQueue;
        withdrawn = toWithdrawFromQueue; // -----> @audit withdrawn is set here
    }

    if (
        toWithdraw != 0 &&
        allowInstantWithdrawals &&
        withdrawalPool.getTotalQueuedWithdrawals() == 0
    ) {
        uint256 toWithdrawFromPool = MathUpgradeable.min(stakingPool.canWithdraw(), toWithdraw);
        if (toWithdrawFromPool != 0) {
            stakingPool.withdraw(address(this), address(this), toWithdrawFromPool, _data);
            toWithdraw -= toWithdrawFromPool; // -----> @audit BUG withdrawn is not updated here
        }
    }
    // ... rest of the function
}

it('instant withdrawals from staking pool are not transferred to staker', async () => {
    const { stakingProxy, stakingPool, priorityPool, signers, token, strategy, accounts } = await loadFixture(deployFixture)

    // Enable instant withdrawals
    await priorityPool.setAllowInstantWithdrawals(true)

    // Deposit initial amount
    await token.approve(stakingProxy.target, toEther(1000))
    await stakingProxy.deposit(toEther(1000), ['0x'])

    // Setup for withdrawals
    await strategy.setMaxDeposits(toEther(2000))
    await strategy.setMinDeposits(0)

    // Track all relevant balances before withdrawal
    const preTokenBalance = await token.balanceOf(stakingProxy.target)
    const preLSTBalance = await stakingPool.balanceOf(stakingProxy.target)

    const prePPBalance = await token.balanceOf(priorityPool.target)

    const withdrawAmount = toEther(500)

    console.log('=== Before Withdrawal ===')
    console.log('Initial LST Balance - Proxy contract:', fromEther(preLSTBalance))
    console.log('Initial Token Balance - Poxy contract:', fromEther(preTokenBalance))


    // Perform withdrawal
    await stakingProxy.withdraw(
        withdrawAmount,
        0,
        0,
        [],
        [],
        [],
        ['0x']
    )

    // Check all balances after withdrawal
    const postTokenBalance = await token.balanceOf(stakingProxy.target)
    const postPPBalance = await token.balanceOf(priorityPool.target)
    const postLSTBalance = await stakingPool.balanceOf(stakingProxy.target)

    console.log('=== After Withdrawal ===')
    console.log('Priority Pool - token balance change:', fromEther(postPPBalance - prePPBalance))
    console.log('Staking Proxy - token balance change:', fromEther(postTokenBalance - preTokenBalance))
    console.log('Staking Proxy - LST balance change:', fromEther(postLSTBalance - preLSTBalance))

    const lstsRedeemed = fromEther(preLSTBalance - postLSTBalance)

    // Assertions

    // 1. Staking Proxy has redeeemed all his LSTs
    assert.equal(
      lstsRedeemed,
        500,
        "Staker redeemed 500 LSTs"
    )

    // 2. But staking proxy doesn't receive underlying tokens
    assert.equal(
      fromEther(postTokenBalance - preTokenBalance),
        0,
        "Staking Proxy didn't receive any tokens despite losing LSTs"
    )

    // 3. The tokens are stuck in Priority Pool
    assert.equal(
        fromEther(postPPBalance- prePPBalance),
        500,
        "Priority Pool is holding the withdrawn tokens"
    )
  })