Liquid Staking

Summary

The PriorityPool contract has a vulnerability in the onlyDistributionOracle modifier, allowing unauthorized addresses to call the updateDistribution function.

Vulnerability Details

The modifier is implemented incorrectly, allowing any address that is not the distributionOracle to successfully call the updateDistribution function. https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L142

The condition if (msg.sender != distributionOracle) should be if (msg.sender == distributionOracle) to properly enforce the access restriction. With the current implementation, any address that is not the distributionOracle can bypass the check and execute the updateDistribution function.

Here's why it is happening.

• The onlyDistributionOracle modifier is intended to restrict access to the updateDistribution function, allowing only the authorized distributionOracle address to call it.

• However, the current implementation of the modifier does not actually enforce this restriction.

• The issue lies in the condition if (msg.sender != distributionOracle). It should be if (msg.sender == distributionOracle) to properly allow only the distributionOracle to proceed.

• With the current implementation, any address that is not the distributionOracle can successfully call the updateDistribution function.

Impact

• Distribute tokens unfairly, favoring certain addresses or excluding others.

• Alter user token balances without proper authorization.

Tools Used

Vs Code

Recommendations

By correcting the condition to if (msg.sender == distributionOracle), only the authorized distributionOracle address will be able to successfully call the updateDistribution function. This ensures that the token distribution process remains secure and can only be executed by the intended oracle.