Liquid Staking

Summary

The strategyDeposit function in StakingPool.sol allows the contract owner to deposit tokens into a specific strategy directly. However, this function does not enforce any checks to limit the maximum amount of tokens that can be deposited into a particular strategy. This lack of checks could lead to an over-deposit situation, where more tokens than intended or allowed are deposited, potentially impacting the overall liquidity management of the pool.

Vulnerability Details

The strategyDeposit function (see https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/StakingPool.sol#L173) has the following code:

The function does not check whether the amount being deposited by the Owner exceeds the maximum allowed by the strategy or if there is sufficient room left for the strategy and the whole pool to accept the deposit.

This contrasts with the StakingPool::_depositLiquidity function, which includes such checks on a strategy utilizing canDeposit before making any deposits (see https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/StakingPool.sol#L477).

Without similar checks in StakingPool::strategyDeposit, there is a risk of over-depositing into a particular strategy and possibly exceeding the maximum amount of tokens that the pool can hold, which could lead to unintended behavior or disruptions in liquidity management.

Impact

The absence of deposit limit checks can result in excessive deposits into a strategy, exceeding its intended capacity. This may lead to funds being concentrated within a single strategy, disrupting optimal liquidity distribution and impairing the overall performance and risk management of the pool.

Tools Used

Manual Code Review, VSCode

Recommendations

Ensure that any direct deposit into strategies via StakingPool::strategyDeposit uses similar checks to those present in StakingPool::_depositLiquidity, enforcing uniform behavior across the contract.
Add checks in the StakingPool::strategyDeposit function to ensure the deposit amount does not exceed the maximum allowed by the strategy and by the whole pool. It can be done by querying the strategy’s canDeposit method to verify the allowed capacity.