Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

decrease in vaultDeposit limits not checked.

mo_

Summary

The current implementation only accounts for an increase in the maxDeposits value but does not handle the scenario where maxDeposits is decreased. This can lead to incorrect calculations and potential issues with vault deposit limits.

Vulnerability Details

if (maxDeposits > vaultMaxDeposits) {
@> uint256 diff = maxDeposits - vaultMaxDeposits;
uint256 totalVaults = globalVaultState.depositIndex;
uint256 numVaultGroups = globalVaultState.numVaultGroups;
uint256 vaultsPerGroup = totalVaults / numVaultGroups;
uint256 remainder = totalVaults % numVaultGroups;
​
for (uint256 i = 0; i < numVaultGroups; ++i) {
uint256 numVaults = vaultsPerGroup;
if (i < remainder) {
numVaults += 1;
}
​
@> vaultGroups[i].totalDepositRoom += uint128(numVaults * diff);
}
​
vaultMaxDeposits = maxDeposits;
}
​

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/CommunityVCS.sol#L89

Impact

As vaults have staking limits in the chainklink staking contracts , Not adjusting the depositRoom may result in unexoected reverts in certain txns and cause DOS .

Tools Used

Manual review & cursor

Recommendations

To address this issue, the logic should be updated to handle both increases and decreases in maxDeposits. Here's a potential solution:

// ... existing code ...
if (maxDeposits != vaultMaxDeposits) {
int256 diff = int256(maxDeposits) - int256(vaultMaxDeposits);
uint256 totalVaults = globalVaultState.depositIndex;
uint256 numVaultGroups = globalVaultState.numVaultGroups;
uint256 vaultsPerGroup = totalVaults / numVaultGroups;
uint256 remainder = totalVaults % numVaultGroups;
​
for (uint256 i = 0; i < numVaultGroups; ++i) {
uint256 numVaults = vaultsPerGroup;
if (i < remainder) {
numVaults += 1;
}
​
// Adjust totalDepositRoom based on whether diff is positive or negative
vaultGroups[i].totalDepositRoom = uint128(int256(vaultGroups[i].totalDepositRoom) + (numVaults * diff));
}
​
vaultMaxDeposits = maxDeposits;
}
// ... existing code ...
​
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.