Liquid Staking

Summary

In the StakingRewardsPool._transferShares , the Transfer event is being emitted using the LST amount equivalent of the shares, which can be misleading for users who are transferring shares instead of the direct token amounts.

Vulnerability Details

In the current implementation, the Transfer event emits the calculated LST amount when shares are transferred. Users who utilize the transferShares function might expect the event to reflect the share amount being transferred, leading to confusion.

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/base/StakingRewardsPool.sol#L167C1-L167C77

Impact

It does not expose the contract to financial theft or manipulation but could potentially lead to misunderstandings about what value is actually being transferred when shares are moved between accounts.

Tools Used

Recommendations

Implement a new ShareTransfer event to distinctly capture share amounts.