Liquid Staking

Summary

Repeated rewards splitting due to the lack of protection against multiple calls to splitRewards(). This vulnerability can be exploited to drain the contract's LST token balance and disrupt the intended fee distribution.

• The splitRewards() function calculates the new rewards by subtracting principalDeposits from the current LST token balance.

• It then splits these rewards among the fee receivers based on their configured basis points.

• However, there is no check to ensure that the rewards haven't already been split in a previous call.

• This means that if splitRewards() is called multiple times, it will split the same rewards each time, effectively multiplying the fees paid out.

Vulnerability Details

splitRewards() calculates the new rewards by subtracting principalDeposits from the current LST token balance, and then splits these rewards based on the fee receivers' basis points. The issue is that there is no check to ensure that the rewards haven't already been split in a previous call.

As a result, an attacker can repeatedly call splitRewards() to split the same rewards multiple times, effectively multiplying the fees paid out to the receivers. This can drain the contract's LST token balance and disrupt the intended fee distribution.

Specifically in the else block where the rewards are split by calling the _splitRewards() function. The issue is that there is no check to prevent repeated calls to splitRewards(), allowing the same rewards to be split multiple times.

We can confirm this by:

1. Call splitRewards() once to split the current rewards correctly.

2. Without any new rewards being added, call splitRewards() again.

3. Observe that the rewards are split again, even though they were already processed in the previous call.

4. Repeating steps 3-4 multiple times to magnify the issue and drain the contract's balance.

Impact

• Incorrect accounting and distribution of rewards

• Loss of funds for users who have deposited LST tokens

Tools Used

Vs Code

Recommendations

Implement a mechanism that prevents repeated calls to splitRewards() within a certain time frame or block range.