Liquid Staking

Summary

In LSTRewardsSplitterController::performUpkeep the underlying logic iterates through all of the underlying splitters and calls their performUpkeep functions. Malicious can front-run the performUpkeep of a splitter and the LSTRewardsSplitterController::performUpkeep will revert.

Vulnerability Details

Let's have the following scenario:

1. Someone wants to call performUpkeep function of LSTRewardsSplitterController with a long list of splitters.

2. Malicious user front-runs the performUpkeep of the last splitter and the principalDeposits is updated to have the same value as lst.balanceOf(address(this)).

3. The call to LSTRewardsSplitterController::performUpkeep begins and the logic tries to call the last splitter, but because of the reward is 0, the call reverts and all of the progress is lost.

Impact

The vulnerability allows a malicious user to front-run the performUpkeep process for a rewards splitter, causing the LSTRewardsSplitterController::performUpkeep function to revert. This leads to the loss of all progress in distributing rewards to multiple splitters. If a front-run attack occurs, the entire upkeep call fails, preventing rewards distribution to other legitimate splitters, and causing inefficiency, wasted gas, and disruption of normal reward operations for the protocol. This makes the system vulnerable to denial of service (DoS) attacks on rewards distribution.

Tools Used

Manual review

Recommendations

Restrict the performUpkeep and splitRewards in splitter to be able to be called only by owner or LSTRewardsSplitterController.