Liquid Staking

Summary

Analysis of Potential Vulnerability in updateFee() Function of LSTRewardsSplitter Contract

Vulnerability Details

A potential logic error exists in the updateFee() function of the LSTRewardsSplitter contract, which may prevent the correct deletion of fees.

When attempting to delete a fee with zero basis points, the function performs an update operation instead of a deletion. This occurs because the function logic only executes the deletion operation when the new feeBasisPoints* is zero.*

poc

a. Add a fee with zero basis points.

b. Attempt to delete this fee using the updateFee() function.

c. Observe that the fee is not deleted but updated instead.\

Impact

This vulnerability could prevent the contract owner from deleting existing fees with zero basis points, affecting the contract's flexibility and maintainability.

Tools Used

vscode

Recommendations

Add a check in the updateFee() function to prevent updating a fee to zero: