Title

claimPeriodActive function will always return false as timeOfLastUpdateByGroup[curUnbondedVaultGroup] is stale

Github link

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/FundFlowController.sol#L133

Summary

claimPeriodActive function will always return false as timeOfLastUpdateByGroup[curUnbondedVaultGroup] is not up-to-date at the moment. In addition to vaults' claim operations, it is used in other operations such as withdraw which amplies further impacts.

Vulnerability Details

The function claimPeriodActive would consistently return false due to a calculation error with the curUnbondedVaultGroup, hindering proper management of vault group claims during unbonding.

The FundFlowController contract is crucial for the protocol, as it manages vault groups one at a time to prevent simultaneous emptying, implemented through claimPeriodActive. This indicates when a vault group is in its claim period. However, due to incorrect updating of timeOfLastUpdateByGroup in updateVaultGroups, where curUnbondedGroup is set to the current instead of the next vault group, claimPeriodActive always returns false as such if called immediately after updateVaultGroups.

Consequently, VaultControllerStrategy.withdraw will always revert since !fundFlowController.claimPeriodActive() would be true perpetually true.

Impact

As well as vaults' claim operations, it is used in other operations such as withdraw which amplies further impacts. It would likely prevent the unbounding of tokens from the vaults.

Recommendations

Ensure to correctly update the timeOfLastUpdateByGroup with nextUnbondedGroup instead of curUnbondedGroup: