Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Batch ID Retrieval in `getBatchIds` Function

mo_

Summary

The getBatchIds function in the WithdrawalPool contract incorrectly calculates batch IDs for withdrawal requests. This issue arises when withdrawal IDs from previous batches are provided, leading to incorrect batch ID assignments. This bug can cause incorrect data retrieval and potential misbehavior in other functions relying on this data.

Vulnerability Details

Steps to Reproduce

  1. Invoke getBatchIds with Previous Batch IDs: Call the getBatchIds function with withdrawal IDs that belong to batches before the current withdrawalBatchIdCutoff.

for (uint256 j = withdrawalBatchIdCutoff; j < withdrawalBatches.length; ++j) {
//...
if (withdrawalId <= indexOfLastWithdrawal) {
batchId = j; //@audit here
break;
}

Notice that the function assigns the current withdrawalBatchIdCutoff as the batch ID for these withdrawal IDs, which is incorrect.

Expected Behavior:
The function should correctly identify and return the batch IDs corresponding to each withdrawal ID, even if they belong to batches before the current withdrawalBatchIdCutoff.

Impact

  • Incorrect Data Retrieval: The function returns incorrect batch IDs, which can lead to incorrect data being displayed on the frontend.

  • Misbehavior in Dependent Functions: Other functions(getFinalizedWithdrawalIdsByOwner()) that rely on the batch IDs returned by getBatchIds may also misbehave, leading to potential errors in withdrawal processing or data presentation.

Tools Used

Manual review

Recommendations

Here's a potential fix for the issue:

function getBatchIds(uint256[] memory _withdrawalIds) public view returns (uint256[] memory) {
uint256[] memory batchIds = new uint256[]();
​
for (uint256 i = 0; i < _withdrawalIds.length; ++i) {
uint256 batchId;
uint256 withdrawalId = _withdrawalIds[i];
​
@> for (uint256 j = 0; j < withdrawalBatches.length; ++j) { // Start from 0 instead of withdrawalBatchIdCutoff
uint256 indexOfLastWithdrawal = withdrawalBatches[j].indexOfLastWithdrawal;
​
if (withdrawalId <= indexOfLastWithdrawal) {
batchId = j;
break;
}
}
​
batchIds[i] = batchId;
}
​
return batchIds;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.