Liquid Staking

Summary

A vulnerability exists in the PriorityPool::claimLSDTokens function where users cannot claim withdrawable liquid staking tokens if the accountClaimed[account] value exceeds the current _amount for a specific claim. This can lead to a Denial of Service (DoS) for users attempting to claim their tokens when their current amount is smaller than the previously claimed amount.

Vulnerability Detail

The PriorityPool::claimLSDTokens function calculates the amount to claim by subtracting the already claimed amount (accountClaimed[account]) from the total amount available (_amount). However, if the already claimed amount is greater than the current _amount, the subtraction results in an underflow (in Solidity 0.8 and later, this causes the transaction to revert). This blocks users from making further claims, effectively preventing them from withdrawing their liquid staking tokens.

The problematic section of the code is:

IfaccountClaimed[account] is greater than _amount or accountSharesClaimed[account] is greate than _sharesAmount, the subtraction will revert, and the claim process will be halted.

Impact

This issue results in a Denial of Service (DoS) for users who cannot claim their tokens due to discrepancies between the current _amount and the previously claimed amount. In practice, this locks users out of their assets if historical claims exceed the currently claimable amount.

Code Snippet

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L365

Tool Used

Manual Review

Recommendation

Really don't know the solution but through try/catch block we can avoide reverting.