Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Insufficient Input Validation in updateFee() Function

radiumx

Summary

Contract: LSTRewardsSplitter.sol
Line: 151

The updateFee() function in the LSTRewardsSplitter contract lacks proper input validation, potentially leading to security vulnerabilities and unexpected behavior.

  • The function does not validate that the _receiver address is non-zero, potentially allowing fees to be sent to the zero address.

  • The _index validation allows updating the fee at index 0, which may not be intended behavior.

  • There's no upper limit check on the _feeBasisPoints parameter, potentially allowing unreasonably high fees to be set for individual receivers.

Vulnerability Details

Original Code:

function updateFee(
uint256 _index,
address _receiver,
uint256 _feeBasisPoints
) external onlyOwner {
require(_index < fees.length, "Fee does not exist");
​
if (_feeBasisPoints == 0) {
fees[_index] = fees[fees.length - 1];
fees.pop();
} else {
fees[_index].receiver = _receiver;
fees[_index].basisPoints = _feeBasisPoints;
}
​
if (_totalFeesBasisPoints() > 10000) revert FeesExceedLimit();
}

Impact

These issues could lead to:

  • Loss of funds if fees are accidentally set to the zero address

  • Unintended modification of a potentially protected fee at index 0

  • Manipulation of fee structures that could drain rewards disproportionately

Tools Used

Remix IDE Desktop

Recommendations

Proposed Code Change with reduced SLOC:

function updateFee(uint256 _index, address _receiver, uint256 _feeBasisPoints) external onlyOwner {
require(_index != 0 && _index < fees.length, "Fee does not exist"); // Check valid index and exclude 0
require(_receiver != address(0), "Receiver Address Is Invalid"); // Ensure valid receiver address
​
if (_feeBasisPoints == 0) {
fees[_index] = fees[fees.length - 1];
fees.pop(); // Remove fee if basisPoints is 0
} else {
fees[_index].receiver = _receiver;
fees[_index].basisPoints = _feeBasisPoints; // Update fee information
}
​
if (_totalFeesBasisPoints() > 10000) revert FeesExceedLimit(); // Ensure total fees do not exceed 100%
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.