Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

StakingPool contract owner can deposit more asset tokens into the strategies than the available deposit room

tejaswarambhe

Summary

StakingPool contract owner can unknowingly deposit more than the available deposit room of the strategy via StakingPool:strategyDeposit

Vulnerability Details

The function strategyDeposit in the StakingPool contract allows the owner to manually deposit asset tokens into the specified strategy.

function strategyDeposit(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyOwner {
require(_index < strategies.length, "Strategy does not exist");
IStrategy(strategies[_index]).deposit(_amount, _data);
}

But the strategies are intended to take deposits of a certain number of tokens as per available deposit room.
As there is no IStrategy(strategies[_index]).canDeposit() check, it allows the StakingPool contract owner to unknowingly deposit more than the available deposit room of the contract.

Impact

Strategy contracts like CommunityVCS, OperatorVCS and others (including future strategy contracts) will hold a risk of getting deposited more tokens than intended.

Tools Used

Manual review

Recommendations

It is recommended to add a IStrategy(strategies[_index]).canDeposit() check before depositing.

​
function strategyDeposit(
uint256 _index,
uint256 _amount,
bytes calldata _data
) external onlyOwner {
require(_index < strategies.length, "Strategy does not exist");
+ @> uint strategyDepositRoom = IStrategy(strategies[i]).canDeposit();
+ @> require(strategyDepositRoom >= _amount, "Insufficient Deposit Room");
IStrategy(strategies[_index]).deposit(_amount, _data);
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

tejaswarambhe Submitter
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.