Liquid Staking

Summary

In both branches of the conditional statement, globalVaultState is reset to a new state:

globalVaultState = GlobalVaultState(5, 0, 0, 0); if address(token) is address(0).
globalVaultState = GlobalVaultState(5, 0, 0, uint64(maxDepositSizeBP + 1)); if address(token) is not address(0).

This reset of globalVaultState could result in a loss of previous state information. If the initialize function is re-entered or called multiple times, the value of globalVaultState would be overwritten, which might not be the intended behavior.

Vulnerability Details

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/OperatorVCS.sol#L52-L88
Issue: The initialize function uses reinitializer(3), allowing multiple calls when the initialization version is 2. The function contains two branches:
If address(token) is address(0), the state is set to GlobalVaultState(5, 0, 0, 0).
If address(token) is not address(0), the state is set to GlobalVaultState(5, 0, 0, uint64(maxDepositSizeBP + 1)).

Potential Problem: Each time the function is called, globalVaultState is reset, potentially overwriting important state data. This can result in the loss of previous state information and unintended changes to maxDepositSizeBP or other vault parameters.

Reinitialization Risk: If the function is callable by unintended parties or if it’s triggered under specific conditions, this behavior could be exploited to manipulate the vault state.

For example, the function overwrites globalVaultState with GlobalVaultState(5, 0, 0, uint64(maxDepositSizeBP + 1)), which seems to imply a modification to maxDepositSizeBP might affect the last parameter in the state. This could create inconsistencies if the previous globalVaultState was supposed to be maintained.

Impact

Loss of State Information: Critical metrics such as user deposits, withdrawals, or rewards might be lost or incorrectly reset.
Inconsistent Behavior: Unexpected changes in globalVaultState could cause discrepancies in how deposits, withdrawals, and rewards are calculated, leading to an unpredictable user experience.

Tools Used

Manual

Recommendations

Restrict Reinitialization: Ensure that the initialize function can only be called under specific conditions or by authorized parties.
Implement State Preservation: Modify the logic to preserve critical aspects of globalVaultState when reinitializing, avoiding full resets unless absolutely necessary.
Validation Before State Changes: Add checks before modifying globalVaultState to confirm that the changes are intentional and appropriate for the current vault state.