Liquid Staking

Summary

whenNotPaused modifier is missing on the PriorityPool.sol::deposit() and PriorityPool.sol::withdraw().

Vulnerability Details

The problem stems from that the PriorityPool::pauseForUpdate() states the following:

*"Pauses queueing and unqueueing so a new merkle tree can be generated" *in the comment above the function declaration. This indicates that whenNotPaused should be present in the PriorityPool::unqueueTokens() as well as on the PriorityPool.sol::withdraw() and PriorityPool::deposit(), the last function responsible for queueing tokens in the PriorityPool.sol.

As we can see, the whenNotPaused modifier is missing on the PriorityPool::deposit() PriorityPool.sol::withdraw().

Impact

Possible queueing of tokens while generations merkle tree root hash will result in unexpected merkle tree root hash.

Tools Used

Manual review

Recommendations

Add the whenNotPaused modifier to the PriorityPool::deposit() and PriorityPool.sol::withdraw() as well.