Liquid Staking

Summary

The use of SafeCast.toUint128 in the OperatorVault and other contracts may lead to unexpected behavior if values exceed the uint128 limit. Casting larger values to smaller types without proper checks can cause overflows or truncation.

Vulnerability Details

In OperatorVault:

If _amount is larger than 2^128 - 1, the SafeCast.toUint128 function will revert. Similar issues may arise elsewhere in the code where type casting is used.

Impact

• Transaction Reverts: Transactions may revert unexpectedly if values exceed type limits.

• Incorrect Calculations: Truncated values may lead to incorrect state updates or calculations.

Tools Used

Manual code review.

Recommendations

• Validate Values Before Casting:

  • Ensure that values being cast to smaller types are within the allowable range.

  • Use require statements to check values before casting.

• Use Appropriate Data Types:

  • If values may exceed uint128, consider using uint256 to avoid unnecessary casting.

• Consistent Data Types:

  • Maintain consistency in data types across functions and variables to reduce casting needs.