Liquid Staking

Summary

A vulnerability has been identified in the PriorityPool.sol contract where the pausing mechanism is not enforced correctly across all deposit-related operations. Specifically, the function _requireNotPaused is only applied to the queuing of deposits, but not to direct deposit operations. This oversight allows users to bypass the pause functionality and continue making deposits when the contract is paused, posing a risk during emergency or maintenance scenarios.

Vulnerability Details

In the PriorityPool.sol contract, the pausing mechanism is intended to prevent certain critical operations (such as deposits) when the contract is in a paused state. However, the current implementation only checks for the paused state in certain scenarios—specifically, when a user attempts to queue their deposit. If the user chooses not to queue their deposit, the contract does not verify whether it is paused or not, and the deposit is processed regardless of the pause status.

This issue arises because the _requireNotPaused function is only applied inside a conditional block that checks whether the user intends to queue their deposit (_shouldQueue). As a result, users can still directly deposit tokens into the pool when the contract is paused, bypassing the intended safeguards.

Affected Code in PriorityPool.sol:

In the above code, the _requireNotPaused() function is only called when the user chooses to queue their deposit (_shouldQueue == true). However, if the user opts for a direct deposit (_shouldQueue == false), no such check is performed, and the deposit is processed without verifying the paused state of the contract.

Impact

This vulnerability allows users to continue depositing tokens into the pool even when the contract is paused.

Tools Used

Manually

Recommendations

To address this vulnerability and ensure that no deposits are processed when the contract is paused, the _requireNotPaused() check should be applied to all deposit paths, not just when the user opts to queue their deposit. This can be done by enforcing the pause check at the beginning of the _deposit function, regardless of the user’s choice to queue or not.