Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing address(0) check in the `StakingPool::deposit` function.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L111

Summary

Address to stake liquid staking tokens can be address(0).

Vulnerability Details

When staking asset tokens and minting liquid staking tokens with the `StakingPool::deposit` function, the `_account` which receive the token can be `address(0)` which is an invalid address.Any tokens sent to it will never be recovered:

function deposit(
address _account,
uint256 _amount,
bytes[] calldata _data
) external onlyPriorityPool {
// @audit lack of address(0) check, can deposit into invalid address
/// ... The rest of code
}

Impact

Possibility of loss of funds when _account=address(0) .

Tools Used

Manual review.

Recommendations

function deposit(
address _account,
uint256 _amount,
bytes[] calldata _data
) external onlyPriorityPool {
+ require(_account != address(0), "Invalide address");
/// ... The rest of code
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.