Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

All tokens to be queued are lost in the priority pool when queuing is paused

x18a6

Summary

When queuing is paused, alltoDeposit tokens to be queued are lost in the priority pool because the PriorityPool#_deposit does not handle the tokens properly.

Vulnerability Details

After attempting to deposit into the withdrawal and staking pools, if:

  • There are still tokens left (toDeposit != 0) and,

  • _shouldQueue is true

then the PriorityPool#_deposit function will attempt to queue the tokens in the relevant accountQueuedTokens array:

core/priorityPool/PriorityPool.sol#L632-L644

function _deposit(address _account, uint256 _amount, bool _shouldQueue, bytes[] memory _data) internal {
// 1) deposit into the withdrawal and staking pools
​
if (toDeposit != 0) {
// 2) still have tokens left to deposit
​
if (_shouldQueue) {
// 3) _shouuldQueue is true
_requireNotPaused();
​
// ❗️ tokens `toDeposit` are lost in the priority pool when queuing is paused
​
if (accountIndexes[_account] == 0) {
accounts.push(_account);
accountIndexes[_account] = accounts.length - 1;
}
accountQueuedTokens[_account] += toDeposit;
totalQueued += toDeposit;
} else {
token.safeTransfer(_account, toDeposit);
}
}
}

The issue is that the PriorityPool#_deposit function requires queuing is not paused _requireNotPaused(); but doesn't handle the tokens to be queued when it's paused.

A crucial point to understand is that only the the queuing branch has pausing logic, depositing into the withdrawal and staking pools does not i.e, they will deposit tokens regardless of whether queuing is paused or not. If there excess tokens are queued when queuing is paused, they will be lost.

Impact

High: all excess tokens toDeposit are lost in the priority pool when queuing is paused. The amount could be large for stakers willing to wait for their turn stake.

Likelihood

Low: only when queuing is paused and there are tokens toDeposit.

Tools Used

Manual Review.

Recommendations

Either pause the whole deposit function or handle the excess tokens properly when queuing is paused.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.