Liquid Staking

Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Submission Details
Severity: high
Invalid

Lack of slippage forces operators to incur losses

Summary

Lack of slippage forces operators to incur losses when _amount > withdrawableRewards.

Vulnerability Details

Take a look at https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/OperatorVCS.sol#L115-L130

function withdrawOperatorRewards(
address _receiver,
uint256 _amount
) external returns (uint256) {
if (!vaultMapping[msg.sender]) revert SenderNotAuthorized();
IERC20Upgradeable lsdToken = IERC20Upgradeable(address(stakingPool));
uint256 withdrawableRewards = lsdToken.balanceOf(address(this));
uint256 amountToWithdraw = _amount > withdrawableRewards
? withdrawableRewards
: _amount;
unclaimedOperatorRewards -= amountToWithdraw;
lsdToken.safeTransfer(_receiver, amountToWithdraw);
return amountToWithdraw;
}

This function is called by vaults to withdraw operator rewards. The issue, however, is that it uses a hardcoded slippage, which forces operators to incur losses.

Step-by-step POC:

  • Operator reward is 100.

  • Vault calls this to withdraw the operator rewards.

  • OperatorVCS.sol balance is 50.

  • Rewards that get withdrawn to the operator is only 50, skimming off 50% from the operator.

Impact

Rewards would be skimmed off of operators since even something that's not accepted by them could end up being sent to them.

Tools Used

Manual review

Recommendations

Either allow the passing of a slippage value or update the accounting correctly, i.e., if _amount > withdrawableRewards, send withdrawableRewards but don't clear the state and later on when funds are available send the remaining, i.e., _amount - withdrawableRewards.

Updates

Lead Judging Commences

inallhonesty Lead Judge
9 months ago
inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.