DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing minimum and maximum unstake checks in BridgeSteth.sol

falconhoof

Summary

WithdrawalQueue.sol::requestWithdrawals() contains min and max msg.value checks. Before BridgeSteth.sol::unstake() calls WithdrawalQueue.sol::requestWithdrawals() it should check msg.value in user transactions.

Vulnerability Details

The minimum value is defined as 100 wei by MIN_STETH_WITHDRAWAL_AMOUNT at WithdrawalQueue.sol#L52 and used in WithdrawalQueue.sol::_checkWithdrawalRequestAmount.sol (see links).

The minimum value is defined as 1000 * 1e18 (1000 ether) by MAX_STETH_WITHDRAWAL_AMOUNT at WithdrawalQueue.sol#L57 and used in WithdrawalQueue.sol::_checkWithdrawalRequestAmount.sol (see links).

Impact

Any withdrawl request below minimum or above maximum will cause the transaction to revert. This means the user's transaction will fail and user will lose the gas costs associated with that transaction and have bad user experience.

Tools Used

Manual Review

Recommendations

Update BridgeSteth.sol::unstake() to include:

  • A minimum check that uint256 amount is greater than 100 wei

  • A maximum check that uint256 amount is not greater than 1000 ether
    *** hardcoded in example, would be better to use WithdrawalQueue.sol functions to get up to date values

function unstake(address to, uint256 amount) external onlyDiamond {
// Check if the amount is within the min and max values
>>> require(amount >= 100, "Amount is below the minimum threshold");
>>> require(amount <= 1000 ether, "Amount exceeds the maximum threshold");
​
uint256[] memory amountArray = new uint256[](1);
amountArray[0] = amount;
uint256 requestId = unsteth.requestWithdrawals(
amountArray,
address(this)
)[0];
unsteth.safeTransferFrom(address(this), to, requestId);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
about 2 years ago
0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Invalidated
Reason: Other
falconhoof Submitter
about 2 years ago
0xnevi Lead Judge
about 2 years ago
falconhoof Submitter
about 2 years ago
0xnevi Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-542

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.