stake.link

Summary

delegatorPool address is never initialized in SDLPoolPrimary::initialize function resulting in user stake migrations always reverting/failing.

Vulnerability Details

On deploying the SDLPrimaryPool, addresses of the sdlToken and boostController are set, if the delegatorPool is not set at that point, we go ahead and initialize the SDLPoolBase which is inherited by the SDLPoolPrimary contract. However, since we never got to initialize the delegatorPool variable, we'll essentially never make it into that else block in the initialize function resulting in the delegatorPool staying zero/un-initialized. This will result in migrate failing every time since we try to compare the msg.sender to a zero address which will return false.

Context::SDLPoolPrimary::initialize

Context: SDLPoolPrimary::_migrate

As you can see from the function initialize above, if the delegatorPool address is not set or an address 0, then it initializes the SDLPoolPrimary. The delegatorPool stays un-initialized at this point. The else block won't be reached because the address of the delegatorPool is not set.

Tools Used

Manual Review

Impact

Unable to migrate users from DelegatorPool to SDLPoolPrimary.

Recommendation

Initialize the delegatorPool variable or expose a function to be able to handle setting it at any time by the protocol.