Liquid Staking

GitHub
https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/base/Vault.sol

Summary

The Vault contract uses block.timestamp to check whether the claim period is active. This introduces a potential vulnerability since miners can manipulate block.timestamp within a range of approximately 15 minutes (900 seconds), potentially leading to undesired outcomes. The contract should use block.number for more reliable time-based calculations, minimizing the risk of manipulation by miners.

Vulnerability Details

In the original implementation, block.timestamp is used to determine whether the claim period is active

Miners can manipulate block.timestamp within a small range, which may allow them to gain unfair advantages, such as making the claim period appear shorter or longer than intended.

Impact

The impact of this vulnerability is that miners may manipulate the outcome of time-based events, such as:
- Extending or shortening the claim period by exploiting block.timestamp.
- Potentially locking funds in the contract longer than expected.
- Disrupting the normal functioning of the vault, affecting participants interacting with the staking contract.

Tools Used

Manual Review

Recommendations

To prevent block.timestamp manipulation, use block.number for time-sensitive logic, combined with an estimate of block times. Below is the recommended change:

This approach mitigates the vulnerability by using the more stable block.number for time comparisons and reduces the risk of miners manipulating the contract’s logic.