Liquid Staking

Summary

The updateStrategyRewards function in the StakingPool contract may inaccurately calculate and distribute rewards and fees when there are abrupt changes in strategy deposits or fee structures. This can lead to incorrect accounting and potential financial discrepancies.

Vulnerability Details

The vulnerability arises from the reliance on dynamic data from strategies without sufficient validation or safeguards against sudden changes. The issue is primarily located in the _updateStrategyRewards function, where it aggregates rewards and fees from multiple strategies.

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L530-L538

Scenario:

1. A strategy experiences a significant change in deposit value due to market volatility or operational adjustments.

2. The updateStrategyRewards function is called, and the sudden change is not adequately accounted for, leading to incorrect calculations of rewards and fees.

3. The function distributes rewards and fees based on these inaccurate calculations, resulting in some stakeholders receiving more or less than they are entitled to.

Impact

Stakeholders may receive incorrect amounts of rewards or fees, leading to potential financial losses or gains.

Tools Used

Manual review

Recommendations

Implement checks to validate the integrity of data received from strategies before using it in calculations.