Liquid Staking

Summary

Vulnerability Details

Lines of impacted code:

• https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/PriorityPool.sol#L636

address[] private accounts; is a dynamic list which only grows during the lifetime of priority pool contract. At the moment there is no way to remove items from this list. If grown in significant size it might be difficult to traverse through or retrieve items from this list. It might break multiple private/public functions including getAccountData.

Impact

Continuously growing accounts might break PriorityPool contract.

Tools Used

Manusl

Recommendations

Have a mechanism to put a hard cap on accounts and delete items from accounts.