Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`_depositLiquidity()` will never run in `else` statement because amount will never be 0(Zero)

0xaraj

Summary

_depositLiquidity() will never run in else statement because amount will never be 0(Zero) in stakingPool:deposit()

Vulnerability Details

In stakingPool::deposit(), if amount > 0 then tokens are transfered to the pool & shares are minted but if amount = 0 then only _depositLiquidity() is called.

function deposit(
address _account,
uint256 _amount,
bytes[] calldata _data
) external onlyPriorityPool {
require(strategies.length > 0, "Must be > 0 strategies to stake");
​
uint256 startingBalance = token.balanceOf(address(this));
​
if (_amount > 0) {
token.safeTransferFrom(msg.sender, address(this), _amount);
_depositLiquidity(_data);
_mint(_account, _amount);
totalStaked += _amount;
} else {
@> _depositLiquidity(_data);
}
...
}

The problem is, amount will never be 0(zero). Let's see how

So, deposit() is called by priorityPool:_deposit() and if you see the amount parameter for deposit(), it is calculated based on toDeposit & canDeposit value, which will never be 0(zero) as there are checks to prevent that. As result, toDepositIntoPool(amount) will never be 0(zero)

function _deposit(
address _account,
uint256 _amount,
bool _shouldQueue,
bytes[] memory _data
) internal {
...
@> if (toDeposit != 0) {
uint256 canDeposit = stakingPool.canDeposit();
@> if (canDeposit != 0) {
@> uint256 toDepositIntoPool = toDeposit <= canDeposit ? toDeposit : canDeposit;
stakingPool.deposit(_account, toDepositIntoPool, _data);
toDeposit -= toDepositIntoPool;
}
}
}
...
}

Impact

_depositLiquidity() in the else statement will never be called because amount is never zero(0)

Tools Used

Manual Review

Recommendations

Remove the if-else statement

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.