Liquid Staking

Github

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/OperatorVCS.sol#L352

Description

The updateVaultGroupAccounting function in the OperatorVCS contract contains a logic flaw that prevents reducing the value of vaultMaxDeposits. The current implementation only allows increases in the deposit limit, which could result in incorrect deposit accounting and inflexibility in updating vault configurations. This conditional logic only updates vaultMaxDeposits if the new value is greater than the current value. If there is a need to reduce the deposit limit, this logic prevents the update, leaving vaultMaxDeposits higher than intended.

Impact

If the staking pool reduces the deposit limit for operational reasons (e.g., slashing, reduced pool capacity), the vault strategy cannot apply the new lower limit.

Tools Used

Manual Review

Recommendations

To allow both increases and decreases, remove the conditional check:

This change ensures the contract always reflects the latest intended deposit limit, whether it is increased or decreased.