Liquid Staking

Summary

depositsSinceLastUpdate represents the total number of tokens deposited into the staking pool since the last distribution, while sharesSinceLastUpdate indicates the total number of shares received for tokens deposited into the staking pool since the last distribution. When withdrawing, both the total number of deposited tokens and the total number of received shares are reduced.

Vulnerability Details

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L672

In the withdraw function, the total number of deposited tokens and the total number of received shares are decreased. However, the total number of deposited tokens remains unchanged when making a withdrawal.

Impact

wrongly calculated sharesSinceLastUpdate and depositsSinceLastUpdate

Tools Used

Manual code review

Recommendations

Reduce sharesSinceLastUpdate and depositsSinceLastUpdate when making a withdrawal.