Liquid Staking

Summary

Vaults are created from the factory via CREATE1. An attacker can front-run deployVault to deploy at the same address, but with different config. If the deployed chain reorg, a different vault might also be deployed at the same address.

Vulnerability Details

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/base/VaultControllerStrategy.sol#L723

function _deployVault(bytes memory _data) internal {
address vault = address(new ERC1967Proxy(vaultImplementation, _data));
token.safeApprove(vault, type(uint256).max);
vaults.push(IVault(vault));
}

function _deployVaults(uint256 _numVaults) internal {
bytes memory data = abi.encodeWithSignature(
"initialize(address,address,address,address)",
address(token),
address(this),
address(stakeController),
stakeController.getRewardVault()
);
for (uint256 i = 0; i < _numVaults; i++) {
_deployVault(data);
}

Impact

Tools Used

Recommendations

Use CREATE2 and the vault config as salt.