MorpheusAI

Summary

Stake doesn't validate if the staker is payable or not, which raise issue on claiming reward

Vulnerability Details

When staking, protocol doesn't check if staker address is payable or not,

here, the staker address is captured using _msgSender() which is from OZ lib, OwnableUpgradeable -> ContextUpgradeable

previously, this _msgSender() is payable, but since OZ move Context from GSN to utils directory, the payable is removed.

So, address which is not payable can still stake. (there is no payable requirement in _stake function). Generally if staker address is an EOA, it is payable, but if the staker is a contract, which is might not be a payable type (lack of receive ether), there will be an issue on claiming.

When claiming, it will call L1Sender with msg.value,

the sendMintMessage send msg.value with 3 parameters, with the implementation as follow:

here the refundTo is set to _msgSender(), while it is expected to be a payable on sendMintMessage. Thus, a non payable address can stake, but will be issue when claim.

Impact

A non payable address (contract) can stake, but then can't claim, loosing their reward.

Tools Used

Manual analysis

Recommendations

Consider explicitly prevent a non-payable address to stake, by casting the _msgSender() with payable, or else they will can't claim their reward.