Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

getDepositsSinceLastUpdate return bigger values than expected

meeve

Summary

The getDepositsSinceLastUpdate function is intended to return the amount of tokens and shares that have been deposited into Chainlink from the queue. The _depositQueuedTokens function correctly updates the depositsSinceLastUpdate and sharesSinceLastUpdate values. But, there is another part of the code where these values are being modified, even though they should not be.

Vulnerability Details

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L672

It seems that this function incorrectly increases the tracked amount of token deposits and shares since the last update, even though it shouldn't affect these values. Withdrawing has nothing to do with depositing into Chainlink.

function _withdraw(
address _account,
uint256 _amount,
bool _shouldQueueWithdrawal
) internal returns (uint256) {
...
if (totalQueued != 0) {
uint256 toWithdrawFromQueue = toWithdraw <= totalQueued ? toWithdraw : totalQueued;
totalQueued -= toWithdrawFromQueue;
depositsSinceLastUpdate += toWithdrawFromQueue;
sharesSinceLastUpdate += stakingPool.getSharesByStake(toWithdrawFromQueue);
toWithdraw -= toWithdrawFromQueue;
}
...
}

Impact

It's easy for anyone to bump these values a lot by depositing, and withdrawing tokens from the queue many times.

getDepositsSinceLastUpdate would return much bigger values, than it should. It would be saying that the protocol deposited a lot of funds into chainlink stacking, while it might happen that it did not deposit any founds

Tools Used

Manual Review

Recommendations

Remove two mentioned lines (672-673)

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`depositsSinceLastUpdate` and `sharesSinceLastUpdate` can be manipulated by repeated deposit and withdrawal

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.