Liquid Staking

Summary

When CommunityVCS is being removed through removeStrategy function in StakingPool contract, it does not update the accrued rewards. As a result, loss of funds happen.

Vulnerability Details

When a strategy is removed from staking pool, it first accrues rewards for the strategy and withdraw all assets from the strategy.
This process is completed by calling _updateStrategyRewards which calls updateDeposits function of the strategy that handles rewards.

However, CommunityVCS contract has dedicated function claimRewards for fetching rewards, which is not called when the strategy is being removed.

Impact

Loss of rewards accrued in CommunityVCS.

Tools Used

Manual Review

Recommendations

When the strategy is being removed, there has to be a logic implemented to call claimRewards before withdrawing assets from the strategy.

One recommendation would be overriding updateDeposits function in CommunityVCS contract that calls claimRewards and then call super.updateDeposits.