Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

The `removeVault` function does not properly handle cases where the vault does not exist in the vaults array

biakia

Summary

In OperatorVCS contract, the function removeVault does not properly handle cases where the vault does not exist in the vaults array. As a result, the first element will be mistakely removed.

Vulnerability Details

function removeVault(uint256 _queueIndex) public {
address vault = vaultsToRemove[_queueIndex];
​
vaultsToRemove[_queueIndex] = vaultsToRemove[vaultsToRemove.length - 1];
vaultsToRemove.pop();
​
_updateStrategyRewards();
(uint256 principalWithdrawn, uint256 rewardsWithdrawn) = IOperatorVault(vault).exitVault();
​
totalDeposits -= principalWithdrawn + rewardsWithdrawn;
totalPrincipalDeposits -= principalWithdrawn;
​
uint256 numVaults = vaults.length;
uint256 index;
for (uint256 i = 0; i < numVaults; ++i) {
if (address(vaults[i]) == vault) {
index = i;
break;
}
}
for (uint256 i = index; i < numVaults - 1; ++i) {
vaults[i] = vaults[i + 1];
}
vaults.pop();
​
token.safeTransfer(address(stakingPool), token.balanceOf(address(this)));
}

The primary logical vulnerability in this code lies in the method used to remove a vault from the vaultsToRemove array and the subsequent removal from the vaults array. The issue arises during the element shifting process within the vaults array. After finding the index of the vault to be removed, the code does not properly handle cases where the vault does not exist in the vaults array. If the vault specified by _queueIndex is not found, the index remains zero as initialized, potentially leading to unintended behavior by removing the first element or shifting the wrong index.

Impact

If the vault specified by _queueIndex is not found, the first element will be mistakely removed.

Tools Used

Manual Review

Recommendations

To mitigate this issue, checks must be put in place to ensure that the vault being removed exists within the vaults array before proceeding to remove it.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[INVALID]`removeVault` function does not properly handle cases where the vault does not exist in the vaults array - It removes element at index 0

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.