Liquid Staking

Summary

Lack of slippage forces operators to incur losses when _amount > withdrawableRewards.

Vulnerability Details

Take a look at https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/OperatorVCS.sol#L115-L130

This function is called by vaults to withdraw operator rewards. The issue, however, is that it uses a hardcoded slippage, which forces operators to incur losses.

Step-by-step POC:

• Operator reward is 100.

• Vault calls this to withdraw the operator rewards.

• OperatorVCS.sol balance is 50.

• Rewards that get withdrawn to the operator is only 50, skimming off 50% from the operator.

Impact

Rewards would be skimmed off of operators since even something that's not accepted by them could end up being sent to them.

Tools Used

Manual review

Recommendations

Either allow the passing of a slippage value or update the accounting correctly, i.e., if _amount > withdrawableRewards, send withdrawableRewards but don't clear the state and later on when funds are available send the remaining, i.e., _amount - withdrawableRewards.