Summary

The FundFlowController constructor recieves the current unbonding period value used in the chain link Stakie.sol contract, but the problem here is that the unbonding period can also be updated; this will affect all the operations of 'FundFlowController.` More details are given in the subsequent section.ngPoolBas

Vulnerability Details

Upon reviewing the FundFlowController code, we found that the unbonding period is set within the initialization process. However, there is no setter function available to update the unbonding period if it changes in the chain link staking contract.

Now, let's take a look at the chain link staking pool base, where they have implemented a function to update the unbonding period

A limit check is in place to control the extent to which the claim period can be updated.

current claim Period : 728 days , but it can be changed to any value between >0 to 60 days.

The following functions of FundFlowController and VaultDepositController contract functions will be affected:

1. claimPeriodActive

2. updateVaultGroups

3. VaultControllerStrategy:withdraw

4. VaultControllerStrategy::getMinDeposits()

Impact

1. Since the unbonding period can be increased or decreased, it may result in a DoS for unbonding operations.

2. The claimPeriodActive function may return incorrect responses.

3. The withdraw function could face a DoS issue, as the protocol might assume it can withdraw funds when, in reality, it cannot.

Tools Used

Manual Review

Recommendations

Instead of storing the unbondingPeriod within the FundFlowController contract, use the StakingPoolBase::getUnbondingParams function, which will always return the current unbondingPeriod.