Liquid Staking

Summary

Transferring the LSTRewardsSplitterController to a new owner continues to persist ownership of the child LSTRewardSplitters against the previous owner.

Vulnerability Details

When the LSTRewardsSplitterController adds a new LSTRewardSplitter, ownership of the created LSTRewardSplitter goes to the current owner of the LSTRewardsSplitterController:

However, as LSTRewardSplitterController is Ownable, if the LSTRewardSplitterController itself were to be transferred to a new owner, old splitters continue to be recorded against the older owner.

Impact

Ownership transfer results in the inadvertant inability to administer splitters.

Tools Used

Manual Review

Recommendations

Always configure the LSTRewardsSplitterController as the owner of child LSTRewardSplitters, as ownership transfer of the LSTRewardsSplitterController will implicitly transfer ownership of the related splitters.

This will require the LSTRewardSplitterController to expose an external interface to appropriate manage the owned splitters; the simplest way to achieve this would to expose an open external call to the LSTRewardsSplitterController owner.