WithdrawalPool::performUpkeep can be front-run with less vaults in parameter, preventing priorityPool.executeQueuedWithdrawals() from withdrawing sufficient amount of funds
Summary
WithdrawalPool::performUpkeep is supposed to be called by Chainlink as an automation, but anyone can call the function if the conditions are met, providing an incorrect value for the parameter _performData, forcing the withdraw function to execute with less vaults than intended, resulting in less rewards being withdrawn.
Vulnerability Details
As long as the vault passed in parameter is the last vault use, withdraw will execute, and performUpkeep will go on a cooldown for minTimeBetweenWithdrawals amount of time.
Impact
Less funds withdrawn for stakers, or even no funds if the vault is empty.
Tools Used
Manual review.
Recommendations
Compute automatically the value of _performData in performUpkeep so it is always called with the necessary value for the vaults.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.