Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inability to remove a strategy from `StakingPool` because of minimum deposits

bladesec

Summary

When an admin of StakingPool contract tries to remove a strategy by calling removeStrategy, it will revert because of minimum deposit logic in strategy contract.

Vulnerability Details

Here's a code snippet of removeStrategy function:

uint256 totalStrategyDeposits = strategy.getTotalDeposits();
if (totalStrategyDeposits > 0) {
strategy.withdraw(totalStrategyDeposits, _strategyWithdrawalData);
}

It calls withdraw function of the strategy with total deposits.
However, each strategy has minimum deposits amount that should be kept in the contract.

As a result, the withdraw transaction fails because it tries to withdraw more than allowed.

Impact

  • Admin can not remove a strategy

Tools Used

Manual Review

Recommendations

There should be a dedicated function defined in strategy that is called to withdraw the entire assets without checking minimum deposits.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.