Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Non-Resetting Deposit Index May Prevent Token Deposits to Non-Group Vaults

gajiknownnothing

Summary

The VaultControllerStrategy::_depositToVaults() function handles depositing leftover tokens (toDeposit) into non-group vaults, starting from the index tracked by globalState.depositIndex. However, if the deposit index reaches the length of the vaults array, it does not reset. This causes any remaining tokens to be prevented from being deposited into non-group vaults in future deposit cycles.

Vulnerability Details

The globalState.depositIndex is intended to track the next non-group vault that should receive a token deposit. However, if globalState.depositIndex reaches the length of the vaults array (vaults.length), it is not reset to start from the first non-group vault.

VaultControllerStrategy::_depositToVaults():

File: VaultControllerStrategy.sol
260: // deposit into additional vaults that don't yet belong to a group
261: uint256 numVaults = vaults.length;
262:>> uint256 i = globalState.depositIndex;
263:
264: while (i < numVaults) {
265: IVault vault = vaults[i];
266: uint256 deposits = vault.getPrincipalDeposits();
267: uint256 canDeposit = _maxDeposits - deposits;
268:
269: // cannot leave a vault with less than minimum deposits
270: if (deposits < _minDeposits && toDeposit < (_minDeposits - deposits)) {
271: break;
272: }
273:
274: if (toDeposit > canDeposit) {
275: vault.deposit(canDeposit);
276: toDeposit -= canDeposit;
277: } else {
278: vault.deposit(toDeposit);
279: if (toDeposit < canDeposit) {
280: toDeposit = 0;
281: break;
282: }
283: toDeposit = 0;
284: }
285:
286:>> ++i;
287: }
288:
289:>> globalVaultState.depositIndex = uint64(i); // <<< global.depositIndex never reset

Impact

This issue prevents the contract from properly distributing leftover tokens to non-group vaults once the index reaches the end of the vaults array.

Tools Used

vscode

Recommendations

Ensure that the globalState.depositIndex is reset to the first of the non-group vaults once it reaches vaults.length.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.