Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Incorrect Access Control

eagles

Summary

Vulnerability Details

The functions starkingPool.sol::strategyDeposit and starkingPool.sol::strategyWithdraw have incorrect access control. According to the documentation, the strategy contracts are managed by the pool, which is the priorityPool. As a result, the strategyDeposit and strategyWithdraw functions in starkingPool.sol should not be restricted by the onlyOwner modifier, as the strategy contracts are controlled by the pool, specifically the priorityPool, rather than by an owner.

function strategyDeposit(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyOwner { //@audit incorrect access control
require(_index < strategies.length, "Strategy does not exist");
IStrategy(strategies[_index]).deposit(_amount, _data);
}
​
​
​
function strategyWithdraw(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyOwner { //@audit incorrect access control
require(_index < strategies.length, "Strategy does not exist");
IStrategy(strategies[_index]).withdraw(_amount, _data);
}
​

Impact

This restricts the function to being called by onlyOwner, which limits scalability since the strategy is actually controlled by the pool, not the owner.

Tools Used

Manual Review

Recommendations

The recommended solution for this vulnerability is to replace the onlyOwner modifier with the onlyPriorityPool modifier.

function strategyDeposit(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyPriorityPool {
require(_index < strategies.length, "Strategy does not exist");
IStrategy(strategies[_index]).deposit(_amount, _data);
}
​
​
function strategyWithdraw(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyPriorityPool {
require(_index < strategies.length, "Strategy does not exist");
IStrategy(strategies[_index]).withdraw(_amount, _data);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.