Liquid Staking

Summary

Return Value of OperatorVault::deposit()transfer function is not checked .

Vulnerability Details

This line in OperatorVault::deposit()

doesn't check the return value of transferAndCall . The IERC677 implementation returns a bool , which is never checked.

Impact

1. While the likelihood is not that much , but if it fails , there will be inconsistency in thestate of the protocol and the vault.

2. The trackedTotalDeposits variable will still be updated which is used in many functions in the OperatorVault .

Recommendations

1. Add a require statement.

2. function deposit(uint256 _amount) external override onlyVaultController {

   trackedTotalDeposits += SafeCast.toUint128(_amount); //e Yes, it reverts but wouldn't it be good to add checks before-hand

   token.safeTransferFrom(msg.sender, address(this), _amount);

   bool success = IERC677(address(token)).transferAndCall(address(stakeController), _amount, ""); //@audit Doesn't check the return value , nor there is an emit...the variables are still updated , there are no reverts, assuming the transaction to be succesful

   + require(success, "Transfer and Call to stake controller failed");

   //Add events to track deposits.

   + emit Deposited(msg.sender, _amount);

   }

   ​

3. Similar Findings 1