Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of address(0) check for `_receiver` which can lead to loss of fund in the `VaultControllerStrategy::addFee` and `VaultControllerStrategy::updateFee` functions.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L649

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L663

Summary

Possibility of loss of funds while adding and modifying the fee deposit address.

Vulnerability Details

When adding fee using function VaultControllerStrategy::addFee or modifying it using function VaultControllerStrategy::updateFee, no check is made on the address passed as the _receiver address, even an invalid address such as address(0) can be recorded as the receiving address and when funds are transferred to this address(0) they will be lost forever.

- VaultControllerStrategy::addFee function:

function addFee(address _receiver, uint256 _feeBasisPoints) external onlyOwner {
//@audit missing address(0)check for _receiver
_updateStrategyRewards();
fees.push(Fee(_receiver, _feeBasisPoints));
if (_totalFeesBasisPoints() > 3000) revert FeesTooLarge();
}

- VaultControllerStrategy::updateFee function:

function updateFee(
uint256 _index,
address _receiver,
uint256 _feeBasisPoints
) external onlyOwner {
//@audit missing address(0)check for _receiver
_updateStrategyRewards();
​
/// ... The rest of code
}

Impact

Loss of all `fees` that will be sent to the addres _receiver when its value is address(0).

Tools Used

Manual review.

Recommendations

VaultControllerStrategy::addFee function:

function addFee(address _receiver, uint256 _feeBasisPoints) external onlyOwner {
+ require(_receiver != address(0), "Not a valide address!");
_updateStrategyRewards();
fees.push(Fee(_receiver, _feeBasisPoints));
if (_totalFeesBasisPoints() > 3000) revert FeesTooLarge();
}

- VaultControllerStrategy::updateFee function:

function updateFee(
uint256 _index,
address _receiver,
uint256 _feeBasisPoints
) external onlyOwner {
+ require(_receiver != address(0), "Not a valide address!");
_updateStrategyRewards();
​
/// ... The rest of code
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.