Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`removeSplitter` function reverts when there's rewards in the splitter being removed

bladesec

Summary

In LSTRewardsSplitterController, removeSplitter function is called by admin to remove a splitter, but it tries to withdraw the total balance even after splitting rewards, which results in transaction failure.

Vulnerability Details

Here's the code snippet of removeSplitter function that includes the vulnerability:

uint256 balance = IERC20(lst).balanceOf(address(splitter));
uint256 principalDeposits = splitter.principalDeposits();
if (balance != 0) {
if (balance != principalDeposits) splitter.splitRewards();
splitter.withdraw(balance, _account);
}

When balance is not equal to principal deposits(which means it has rewards), it calls splitRewards for reward distribution.
After the call, it calls withdraw function with previous balance, which is bigger than current balance.

As a result, the transaction reverts.

Impact

  • Admin won't be able to remove a splitter.

Tools Used

Manual Review

Recommendations

The balance has to be refetched to withdraw correct amount.

if (balance != 0) {
if (balance != principalDeposits) splitter.splitRewards();
- splitter.withdraw(balance, _account);
+ splitter.withdraw(IERC20(lst).balanceOf(address(splitter)), _account);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

In `removeSplitter` the `principalDeposits` should be used as an input for `withdraw` instead of balance after splitting the existing rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.