Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing validation in `setQueueDepositParams` function

iamthesvn

Summary

The setQueueDepositParams function in the PriorityPool contract lacks a check to ensure that the minimum deposit value is less than or equal to the maximum deposit value. This oversight could potentially lead to logical errors in the contract's operation.

Relevant links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L549-L556

Vulnerability Details

In the PriorityPool.sol contract, the setQueueDepositParams function allows the owner to set the minimum and maximum deposit parameters without validating their relationship:

function setQueueDepositParams(
//@audit - have a check to see if the _queueDepositMin is lower than _queueDepositMax
uint128 _queueDepositMin,
uint128 _queueDepositMax
) external onlyOwner {
queueDepositMin = _queueDepositMin;
queueDepositMax = _queueDepositMax;
emit SetQueueDepositParams(_queueDepositMin, _queueDepositMax);
}

This function lacks a check to ensure that _queueDepositMin is less than or equal to _queueDepositMax. Without this validation, it's possible to set these parameters in a way that could cause logical errors in other parts of the contract that rely on these values.

Impact

The impact of this vulnerability is low because:

  1. The function is restricted to the contract owner, limiting the potential for malicious exploitation.

  2. It doesn't directly affect user funds or cause immediate security risks.

However, if the parameters are set incorrectly, it could lead to unexpected reverts in functions that rely on these parameters, such as _depositQueuedTokens.

Tools Used

Manual review

Recommendations

To address this vulnerability, it's recommended to add a simple check in the setQueueDepositParams function:

function setQueueDepositParams(
uint128 _queueDepositMin,
uint128 _queueDepositMax
) external onlyOwner {
require(_queueDepositMin < _queueDepositMax, "Min must be < Max");
queueDepositMin = _queueDepositMin;
queueDepositMax = _queueDepositMax;
emit SetQueueDepositParams(_queueDepositMin, _queueDepositMax);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!