Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Incorrect composition of `performData` in `PriorityPool` contract

bladesec

Summary

Based on Chainlink docs, the data returned from checkUpkeep is passed into performUpkeep as a parameter.
However, in PriorityPool contract, checkUpkeep returns abi-encoded uint256 data type, but in performUpkeep, it tries to parse the input as bytes[], which will not work.

Vulnerability Details

Here's a code snippet of checkUpkeep and performUpkeep functions of PriorityPool contract:

function checkUpkeep(bytes calldata) external view returns (bool, bytes memory) {
uint256 strategyDepositRoom = stakingPool.getStrategyDepositRoom();
uint256 unusedDeposits = stakingPool.getUnusedDeposits();
​
if (poolStatus != PoolStatus.OPEN) return (false, "");
if (
strategyDepositRoom < queueDepositMin ||
(totalQueued + unusedDeposits) < queueDepositMin
) return (false, "");
​
return (
true,
abi.encode(
MathUpgradeable.min(
MathUpgradeable.min(strategyDepositRoom, totalQueued + unusedDeposits),
queueDepositMax
)
)
);
}
​
/**
* @notice Deposits queued and/or unused tokens into staking pool strategies
* @dev will revert if less than queueDepositMin tokens can be deposited
* @param _performData encoded list of deposit data to be passed to staking pool strategies (bytes[])
*/
function performUpkeep(bytes calldata _performData) external {
bytes[] memory depositData = abi.decode(_performData, (bytes[]));
_depositQueuedTokens(queueDepositMin, queueDepositMax, depositData);
}

checkUpkeep function returns deposit amount as return value by encoding it into bytes.
And then, the data is passed to performUpkeep, which is decoded into bytes[].

Because of type mismatch, the decoding will fail.

Impact

Failure of queued deposits in PriorityPool contract.

Tools Used

Manual Review

Recommendations

The type used for encode/decode should match.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink Automation integration bad

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!