Liquid Staking

Summary

When an admin of StakingPool contract tries to remove a strategy by calling removeStrategy, it will revert because of minimum deposit logic in strategy contract.

Vulnerability Details

Here's a code snippet of removeStrategy function:

It calls withdraw function of the strategy with total deposits.
However, each strategy has minimum deposits amount that should be kept in the contract.

As a result, the withdraw transaction fails because it tries to withdraw more than allowed.

Impact

• Admin can not remove a strategy

Tools Used

Manual Review

Recommendations

There should be a dedicated function defined in strategy that is called to withdraw the entire assets without checking minimum deposits.