Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `FundFlowController` is unable to update the `claimPeriod` storage variable if the Chainlink Staking contract modifies that value.

federodes

Summary

The current version of the FundFlowController lacks the logic to update the claimPeriod when the Chainlink Staking contract modifies it. As a result, the outdated claimPeriod is used, disrupting the claiming process.

Vulnerability Details

The FundFlowController initializes the claimPeriod during contract setup but does not provide a mechanism to update this value. If the Chainlink Staking contract updates the claimPeriod through the following function: https://etherscan.io/address/0x996913c8c08472f584ab8834e925b06d0eb1d813#code#F18#L786, the claiming logic in the FundFlowController will become misaligned.

contract FundFlowController is UUPSUpgradeable, OwnableUpgradeable {
// address of operator vcs
IVaultControllerStrategy public operatorVCS;
// address of community vcs
IVaultControllerStrategy public communityVCS;
​
// duration of the unbonding period in the Chainlink staking contract
uint64 public unbondingPeriod;
// duration of the claim period in the Chainlink staking contract
@> uint64 public claimPeriod;
​
...
function initialize(
address _operatorVCS,
address _communityVCS,
uint64 _unbondingPeriod,
uint64 _claimPeriod,
uint64 _numVaultGroups
) public initializer {
__UUPSUpgradeable_init();
__Ownable_init();
operatorVCS = IVaultControllerStrategy(_operatorVCS);
communityVCS = IVaultControllerStrategy(_communityVCS);
unbondingPeriod = _unbondingPeriod;
@> claimPeriod = _claimPeriod;
numVaultGroups = _numVaultGroups;
for (uint256 i = 0; i < _numVaultGroups; ++i) {
timeOfLastUpdateByGroup.push(0);
}
}

Impact

This oversight can significantly disrupt the claiming logic, leading to potential errors in token distribution and misalignment between the expected and actual claim periods. As a result, operators may experience confusion regarding their claim eligibility, and the overall integrity of the staking mechanism could be compromised.

Tools Used

Manual review.

Recommendations

Implement a setter function to allow updates to the claimPeriod as needed. Alternatively, consider dynamically retrieving the claimPeriod value directly from the Chainlink Staking contract. This approach ensures that the FundFlowController remains in sync with any changes made to the claimPeriod, maintaining the integrity of the claiming logic.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.