Liquid Staking

Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Submission Details
Severity: medium
Invalid

Missing rewardsThreshold() check in splitRewards()

Summary

In method splitRewards()there is a missing check of rewardsThreshold(). Which can lead to malicious user calling it at a frequency so that fee receivers don't earn any fees.

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L116C1-L125C6

Vulnerability Details

Because of external visibility a malicious user can call this method with certain frequency so that the fee receivers don't earn any fees. As the fees are rounded down during calculation.

uint256 amount = (_rewardsAmount * fee.basisPoints) / 10000;

Impact

This will lead to fee receivers earning no fee and all the rewards getting added to the principalDeposits.

Tools Used

Vs Code

Recommendations

Only trusted users should be allowed to call this method as the external visibility of the method can have above mentioned impact.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.