Liquid Staking

Summary

The addFee function in the LSTRewardsSplitter contract has a vulnerability that allows the total fees to exceed the maximum limit of 100%. Because the function adds the new fee to the fees array before checking if the total fees exceed the limit. As a result, if the total fees are already at 100%, adding any new fee will temporarily push the total above the limit, leading to an invalid fee distribution state.

Vulnerability Details

This happens because the function first adds the new fee to the array and then checks if the total fees exceed the limit. If the total fees are already at 100%, adding any new fee will temporarily push the total above the limit before the revert happens, violating the intended behavior of not allowing total fees to exceed 100%.

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L140-L143

In the order of operations within the addFee function. The new fee is added to the fees array using fees.push(Fee(_receiver, _feeBasisPoints)) before checking if the total fees exceed the limit with if (_totalFeesBasisPoints() > 10000) revert FeesExceedLimit().

This allows the total fees to temporarily exceed the maximum limit of 10000 basis points (100%) if the total fees are already at the limit before adding the new fee. The check should be performed before adding the new fee to ensure that the total fees never exceed the limit.

Impact

1. The contract is designed to enforce a maximum total fee limit of 100%. However, the vulnerability allows the total fees to exceed this limit, resulting in an invalid fee distribution state.

2. If the total fees exceed 100%, it can lead to incorrect calculations of rewards and their distribution among fee receivers. This may result in some receivers getting more rewards than intended, while others may receive less.

Tools Used

Manual Review

Recommendations

Modify the addFee function to perform the limit check before adding the new fee to the fees array. By performing the limit check before adding the new fee, we ensure that the total fees never exceed the maximum limit of 100%, even temporarily.