First Flight #22: Steaking
First Flight #22
Beginner FriendlyFoundryDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of control to restrict no further update allowed on `Steaking:setVaultAddress` once user has started depositing into the vault

soupy

Summary

There is no restriction on how frequent/number of times allowed to set the vault address via Steaking:setVaultAddress. If vault address is reset when there are already deposits in the vault, this could potentially cause loss of fund, loss of proper user deposit records damaging the credibility of the protocol team

https://github.com/Cyfrin/2024-08-steaking/blob/87e81eb617f3bca3dfbd7c6d4c90bdf1c988ebb0/steaking-contracts/src/Steaking.vy#L101-L113

Vulnerability Details

In the contract Steaking:setVaultAddress, there's a check if vault address is non-zero. However, the set vault address can be overwritten if another new vault address is used along with the same function call by the owner again. This could cause users who deposited into the earlier vault address has no proper deposit record with the updated vault address potentially a fund loss or confusion on how the protocol team has moved their funds.

def setVaultAddress(_vault: address):
"""
@notice Allows the owner of this contract to set the WETH Steak vault address after the staking
period has ended.
@param _vault The address of the WETH Steak vault.
"""
assert msg.sender == self.owner, STEAK__NOT_OWNER
assert self._hasStakingPeriodEnded(), STEAK__CANNOT_SET_VAULT_ADDRESS_BEFORE_STAKING_PERIOD_ENDS
assert _vault != ADDRESS_ZERO, STEAK__ADDRESS_ZERO
​
<@@>! self.vault = _vault
​
log VaultAddressSet(_vault)

Impact

Potential loss of fund and confusion to user when vault address is reset

Tools Used

Manual review

Recommendations

Implement a check if vault address is already set/exist

def setVaultAddress(_vault: address):
"""
@notice Allows the owner of this contract to set the WETH Steak vault address after the staking
period has ended.
@param _vault The address of the WETH Steak vault.
"""
assert msg.sender == self.owner, STEAK__NOT_OWNER
assert self._hasStakingPeriodEnded(), STEAK__CANNOT_SET_VAULT_ADDRESS_BEFORE_STAKING_PERIOD_ENDS
assert _vault != ADDRESS_ZERO, STEAK__ADDRESS_ZERO
+ assert self.vault != ADDRESS_ZERO, STEAK__VAULT_ALREADY_EXIST
​
self.vault = _vault
​
log VaultAddressSet(_vault)
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.