Liquid Staking

Summary

This report highlights insufficient input validation in the updateFee function of the LSTRewardsSplitter contract. The absence of checks for the _receiver address and the _index can lead to unintended behavior, such as invalid fee assignments or the accidental removal of fees. Implementing proper validation measures is essential for maintaining the security and reliability of the fee management system.

Vulnerability Details

The updateFee function in the StakingPool contract lacks sufficient input validation for the _receiver address and the _index value. This can lead to the introduction of invalid parameters and unintended consequences for fee management.

Details

• Vulnerable Function: updateFee

• Code Snippet: https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L151

Impact

• Invalid Address: If the _receiver address is invalid (e.g., zero address), it could lead to fees being sent to an unintended or malicious address.

• index Validation: The function allows for a _index value of zero without prior validation, which can lead to unintended behaviour.

Tools Used

Recommendations

Validate _receiver Address: Ensure that the _receiver address is not the zero address to prevent fees being directed to an invalid recipient.

Validate _index: Add a check to ensure that _index is greater than zero when updating a fee.