Summary

The FundFlowController constructor retrieves the current claimPeriod value utilized in the linked StakingPoolBase.sol contract. However, it is important to note that the claimPeriod can be updated, which will impact all operations of the FundFlowController. Further details will be provided in the subsequent section.

Vulnerability Details

Upon reviewing the FundFlowController code, it is observed that the claimPeriod is set within the initialize function, and there is no setter function available to update the claimPeriod if it changes in the Chainlink staking contract.

Now, let us examine the Chainlink Staking Pool Base, which includes a function designed to update the claimPeriod.

Limit check to which the claim period can be updated

The current claimPeriod is set to 7 days, but it can be adjusted to any value ranging from 1 day to 30 days.

The following functions in the FundFlowController and VaultDepositController contracts will be affected:

1. claimPeriodActive

2. updateVaultGroups

3. VaultControllerStrategy:withdraw

4. VaultControllerStrategy::getMinDeposits()

Impact

1. If the claimPeriod is adjusted, the protocol erroneously assumes it can unbind the funds from Chainlink staking, while in reality, it cannot.

2. The claimPeriodActive function will yield an incorrect response.

3. The withdraw function is vulnerable to a Denial of Service (DoS) attack, as the protocol assumes it can withdraw funds when it actually cannot.

Tools Used

Manual Review

Recommendations

Instead of storing the claimPeriod within the FundFlowController contract, it is recommended to utilize the StakingPoolBase::getUnbondingParams, which will consistently return the current claimPeriod.

Or set a setter function for claimPeriod which will update the claimPeriod.