Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Unfair distribution of LST among the stakers

shahilhussain

Summary

stakers are supposed to get LST in intervals based on their reSDL holdings and it is begin handle by merkle proof but when totalQueued in PriorityPool.sol is 0 and there is a queuedWithdrawals amount then stakers who deposit at this time will mint all the LST at that moment resulting in unfair distribution of LST.

Vulnerability Details

function deposit(uint256 _amount, bool _shouldQueue, bytes[] calldata _data) external {
if (_amount == 0) revert InvalidAmount();
token.safeTransferFrom(msg.sender, address(this), _amount);
@> _deposit(msg.sender, _amount, _shouldQueue, _data);
}
​
function _deposit(address _account, uint256 _amount, bool _shouldQueue, bytes[] memory _data) internal {
.
.
.
@> if (totalQueued == 0) {
uint256 queuedWithdrawals = withdrawalPool.getTotalQueuedWithdrawals();
@> if (queuedWithdrawals != 0) {
uint256 toDepositIntoQueue = toDeposit <= queuedWithdrawals ? toDeposit : queuedWithdrawals;
withdrawalPool.deposit(toDepositIntoQueue);
toDeposit -= toDepositIntoQueue;
@> IERC20Upgradeable(address(stakingPool)).safeTransfer(_account, toDepositIntoQueue);
}
.
.
.
}

-> Stakers stake their LINK and are getting LST in invervals based on their reSDL holding handling by merkle Proof.
-> If a stakers deposit their LINK when totalQueued == 0 and queuedWithdrawals != 0, they will get all the corresponding LST instantly if toDeposit <= queuedWtihdrawals instantly.

Impact

This results in unfair distribution of LST as some stakers are getting LST in intervals based on reSDL holdings and others getting all their LST instantly.

Tools Used

Manaul review

Recommendations

Instead of transferring LST transfer the shares and give the LST to the staker on same interval-based system

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.