Liquid Staking

Summary

In method splitRewards()there is a missing check of rewardsThreshold(). Which can lead to malicious user calling it at a frequency so that fee receivers don't earn any fees.

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L116C1-L125C6

Vulnerability Details

Because of external visibility a malicious user can call this method with certain frequency so that the fee receivers don't earn any fees. As the fees are rounded down during calculation.

Impact

This will lead to fee receivers earning no fee and all the rewards getting added to the principalDeposits.

Tools Used

Vs Code

Recommendations

Only trusted users should be allowed to call this method as the external visibility of the method can have above mentioned impact.