Liquid Staking

Summary:
https://github.com/stakedotlink/contracts/blob/native-link-withdrawals/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol

The "LSTRewardsSplitter" contract lacks suficient access contorol on the "splitRewards" function, allowing any user to trigger the reward distribution process.

Vulnerability Details:

Affected Function: splitRewards

function splitRewards() external {

..//

}

The "splitRewards" function is designeed to split newly accrued reward among specified fee receivers. However, it does not implement any access control modifiers, making it accessible to any Ethereum address.

Impact

An attacker can call the "splitRewards" function repeateded to drain or misalocate rewards, diverting funds intended for legitimate users.

Tools Used

The vulnerability was identified through a manual review of the Solidity code, focusing on function definitions and visibility modifiers.

Recommendations

Implement Access Control: Restrict access to the splitRewards function by adding the "onlyController" modifier to ensure only authorized entities can call it.

function splitRewards() external onlyController {
..//
}