Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Potential System Instability When PriorityPool is a Fee Receiver in StakingPool

8olidity

Summary

Potential System Instability When PriorityPool is a Fee Receiver in StakingPool

Vulnerability Details

In the StakingPool contract's _updateStrategyRewards function, when receivers[i][j] corresponds to the PriorityPool address, it can lead to unexpected behavior and potential system instability. This occurs because the transferAndCallFrom function triggers the onTokenTransfer function in PriorityPool, which in turn may call WithdrawalPool.queueWithdrawal, creating a complex chain of interactions between contracts.

// In StakingPool.sol
function _updateStrategyRewards(uint256[] memory _strategyIdxs, bytes memory _data) private {
// ... (code omitted for brevity)
if (totalFeeAmounts > 0) {
for (uint256 i = 0; i < receivers.length; i++) {
for (uint256 j = 0; j < receivers[i].length; j++) {
// This call can trigger complex interactions if receivers[i][j] is PriorityPool
transferAndCallFrom(address(this), receivers[i][j], feeAmounts[i][j], "0x");
}
}
}
// ... (code omitted for brevity)
}
​
// In PriorityPool.sol
function onTokenTransfer(address _sender, uint256 _value, bytes calldata _calldata) external {
// ... (code omitted for brevity)
if (msg.sender == address(stakingPool)) {
uint256 amountQueued = _withdraw(_sender, _value, shouldQueue);
// This may lead to a call to WithdrawalPool
// ... (code omitted for brevity)
}
// ... (code omitted for brevity)
}
​
// In WithdrawalPool.sol
function queueWithdrawal(address _account, uint256 _amount) external onlyPriorityPool {
// ... (code omitted for brevity)
lst.safeTransferFrom(msg.sender, address(this), _amount);
// ... (code omitted for brevity)
}

Impact

This issue could lead to:

  • Unexpected state changes across multiple contracts.

  • Potential reentrancy vulnerabilities.

Tools Used

vscode

Recommendations

Limit fees.receiver to PriorityPool address

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.