Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Deposit breaks when passed _data list of incorrect length

arman

Summary

Vulnerability Details

Lines of impacted code:

  1. https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/StakingPool.sol#L114

  2. https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/PriorityPool.sol#L626

  3. https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/PriorityPool.sol#L718

function _depositLiquidity(bytes[] calldata _data) private {
uint256 toDeposit = token.balanceOf(address(this));
if (toDeposit > 0) {
for (uint256 i = 0; i < strategies.length; i++) {
IStrategy strategy = IStrategy(strategies[i]);
uint256 strategyCanDeposit = strategy.canDeposit();
if (strategyCanDeposit >= toDeposit) {
strategy.deposit(toDeposit, _data[i]);
break;
} else if (strategyCanDeposit > 0) {
strategy.deposit(strategyCanDeposit, _data[i]);
toDeposit -= strategyCanDeposit;
}
}
}
}

The above code breaks when _data.length < strategies.length.

Proof of Concept

Steps to reproduce:

  1. create a test file inside the test folder of the project directory.

  2. copy and paste the code below.

  3. run it with npx hardhat test test/testing-staking-pools.ts --network hardhat command.

Test Code:

import { ethers } from 'hardhat'
import { assert, expect } from 'chai'
import {
toEther,
deploy,
deployUpgradeable,
getAccounts,
setupToken,
fromEther,
} from './utils/helpers'
import { ERC677, StrategyMock, StakingPool, ERC677ReceiverMock } from '../typechain-types'
import { loadFixture } from '@nomicfoundation/hardhat-network-helpers'
​
describe('StakingPool', () => {
async function deployFixture() {
const { signers, accounts } = await getAccounts()
const adrs: any = {}
​
const token = (await deploy('contracts/core/tokens/base/ERC677.sol:ERC677', [
'Chainlink',
'LINK',
1000000000,
])) as ERC677
adrs.token = await token.getAddress()
await setupToken(token, accounts)
​
const erc677Receiver = (await deploy('ERC677ReceiverMock')) as ERC677ReceiverMock
adrs.erc677Receiver = await erc677Receiver.getAddress()
​
const stakingPool = (await deployUpgradeable('StakingPool', [
adrs.token,
'LinkPool LINK',
'lpLINK',
[
[accounts[4], 1000],
[adrs.erc677Receiver, 2000],
],
toEther(10000),
])) as StakingPool
adrs.stakingPool = await stakingPool.getAddress()
​
const strategy1 = (await deployUpgradeable('StrategyMock', [
adrs.token,
adrs.stakingPool,
toEther(1000),
toEther(10),
])) as StrategyMock
adrs.strategy1 = await strategy1.getAddress()
​
const strategy2 = (await deployUpgradeable('StrategyMock', [
adrs.token,
adrs.stakingPool,
toEther(2000),
toEther(20),
])) as StrategyMock
adrs.strategy2 = await strategy2.getAddress()
​
const strategy3 = (await deployUpgradeable('StrategyMock', [
adrs.token,
adrs.stakingPool,
toEther(10000),
toEther(10),
])) as StrategyMock
adrs.strategy3 = await strategy3.getAddress()
​
await stakingPool.addStrategy(adrs.strategy1)
await stakingPool.addStrategy(adrs.strategy2)
await stakingPool.addStrategy(adrs.strategy3)
await stakingPool.setPriorityPool(accounts[0])
await stakingPool.setRebaseController(accounts[0])
​
return {
accounts,
adrs,
token,
stakingPool,
}
}
​
it('deposit should fail when passed _data list of incorrect length', async () => {
const { adrs, accounts, token, stakingPool } = await loadFixture(deployFixture)
​
await token.approve(adrs.stakingPool, ethers.MaxUint256)
await expect(
stakingPool.deposit(accounts[0], toEther(3001), ['0x', '0x'])
).to.be.reverted
})
})
​

Impact

  1. Depositing LINK token in Staking Pool will revert.

  2. Depositors will loose gas.

Tools Used

Hardhat

Recommendations

Add a check where _data.length == strategies.length;

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.