Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Critical Deposit and Withdrawal Data Functions Unused, Potentially Disrupting Protocol Operation

allengeorge

Summary

FundFlowController::getDepositData()and FundFlowController::getWithdrawalData() which are supposed to return the encoded Vault deposit order and Vault withdrawal orders for strategies, are intended to be used in the PriorityPool while depositing into / Withdrawing from StakingPool which further interacts with the OperatorVCS and CommunityVCS , are not used anywhere inside the PriorityPool.

Vulnerability Details

The FundFlowController::getDepositData()and FundFlowController::getWithdrawalData() functions which passes on deposit and withdrawal data for various deposit and withdrawal operations in the PriorityPool is not used anywhere in the PriorityPool contract neither there is a instance of FundFlowController in the Protocol .

function getDepositData(uint256 _toDeposit) external view returns (bytes[] memory) {
uint256 toDeposit = 2 * _toDeposit;
bytes[] memory depositData = new bytes[]();
​
(uint64[] memory opVaultDepositOrder, uint256 opVaultsTotalToDeposit) =
_getVaultDepositOrder(operatorVCS, toDeposit);
depositData[0] = abi.encode(opVaultDepositOrder);
​
if (opVaultsTotalToDeposit < toDeposit) {
(uint64[] memory comVaultDepositOrder,) =
_getVaultDepositOrder(communityVCS, toDeposit - opVaultsTotalToDeposit);
depositData[1] = abi.encode(comVaultDepositOrder);
} else {
depositData[1] = abi.encode(new uint64[]());
}
​
return depositData;
}
function getWithdrawalData(uint256 _toWithdraw) external view returns (bytes[] memory) {
uint256 toWithdraw = 2 * _toWithdraw;
bytes[] memory withdrawalData = new bytes[]();
​
(uint64[] memory comVaultWithdrawalOrder, uint256 comVaultsTotalToWithdraw) =
_getVaultWithdrawalOrder(communityVCS, toWithdraw);
withdrawalData[1] = abi.encode(comVaultWithdrawalOrder);
​
if (comVaultsTotalToWithdraw < toWithdraw) {
(uint64[] memory opVaultWithdrawalOrder,) =
_getVaultWithdrawalOrder(operatorVCS, toWithdraw - comVaultsTotalToWithdraw);
withdrawalData[0] = abi.encode(opVaultWithdrawalOrder);
} else {
withdrawalData[0] = abi.encode(new uint64[]());
}
​
return withdrawalData;
}
​
​

This is catastrophic as it leads to the flow of funds to be completely disrupted by random , corrupted or invalid/wrong data being passed on to StakingPool .

Impact

  1. PriorityPool::deposit()takes in the _dataparameter which is intended to be vault deposit order. It leads to incorrect data being passed on to StakingPool .

  2. PriorityPool::executeQueuedWithdrawals() also takes _dataparameter i.e The Withdrawal Order for vault strategies.

  3. Will lead to disruption of the whole protocol functionality as vault orders will be disrupted leading to reverting and failing of many functionalities .

Tools Used

Manual Code Review

Recommendations

  1. Retrieve the _data for deposit and withdrawal orders from FundFlowController through the getWithdrawalDataand getDepositData and include checks to verify the correct data is being passed to the functions in PriorityPool .

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.