Liquid Staking

Github

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/FundFlowController.sol#L75

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/FundFlowController.sol#L104

Summary

The FundFlowController contract, responsible for managing deposits and withdrawals between the OperatorVCS and CommunityVCS, multiplies the deposit and withdrawal amounts by 2 in the functions getDepositData and getWithdrawalData. This behavior appears unnecessary and can lead to operational inconsistencies. The report explores the impact of this multiplication and the potential risks associated with it.

Vulnerability Details

The deposit and withdrawal amounts are doubled within these function and the resulting doubled amounts are then used to compute the vault deposit and withdrawal orders, which may lead to unexpected behavior. The issue lies in these two functions:

A user providing input _toDeposit or _toWithdraw may expect that exact amount to be deposited or withdrawn, but the system will operate on twice the input amount. Vaults may run out of space or funds prematurely. Also users may encounter failures due to incorrect assumptions about available liquidity.

Since other parts of the vaults and pools expect precise amounts, the inflated figures could cause mismatches in accounting, leading to reverts or system instability. Multiplying amounts might trigger frequent reverts in transactions if the vaults cannot accommodate or provide the doubled amounts, exposing the contract to potential DoS vulnerabilities.

Impact

The system will behave unpredictably due to inflated amounts, leading to transaction failures. Vaults could either run out of liquidity prematurely or prevent legitimate deposits/withdrawals due to incorrect computations. If the vaults frequently hit capacity limits due to doubled amounts, it opens up avenues for attackers to disrupt operations.

Tools Used

Manual Review

Recommendations

Adjust the functions to use the provided input values directly: