Liquid Staking

Summary

Unsafe Conversion of Negative Integer to Unsigned Integer

Vulnerability Details

A potential high-risk security vulnerability exists in the checkUpkeep function of the LSTRewardsSplitter contract. The function directly converts the newRewards variable of type int256, which may be negative, to uint256 when comparing it with controller.rewardThreshold().When newRewards is negative, converting it to uint256 results in an extremely large positive number (2^256 - 1). This will almost always be greater than controller.rewardThreshold(), causing the condition to incorrectly return true. This could lead to the system erroneously executing upkeep when it shouldn't, potentially triggering incorrect reward distributions or other unexpected behaviors.

Impact

Tools Used

vscode

Recommendations

Following the approach used in the performUpkeep function, handle positive and negative cases separately