Liquid Staking

Summary

The function FundFlowController::claimPeriodActive will always return false due to an error in the calculation of the curUnbondedVaultGroup variable. This results in an inability to properly manage vault group claims during the unbonding process.

Vulnerability Details

The FundFlowController plays a major role of the protocol as it unbounds vault groups one at a time, preventing them from being emptied simultaneously, and allowing the protocol to always have one group vault unbounded to allow withdraws. This logic is implemented in the claimPeriodActive function, which is supposed to return true when a vault group is between the start and the end of the claim period.

However, this function will always return false because the variable timeOfLastUpdateByGroup is not updated correctly in updateVaultGroups. The actual group updated at the end of this function is the previous group, as the variable curUnbondedGroup is set to the current vault group. This means the timeOfLastUpdateByGroup of the next group (the one that is in the process of unbonding) isn't updated.
As a result, the variable timeOfLastUpdateByGroup[curUnbondedVaultGroup] in claimPeriodActive will return a previous, incorrect value of a past update.

If claimPeriodActive would be called right after updateVaultGroups, the assertion block.timestamp > claimPeriodEnd would already be true, proving the claimPeriodActive function can never return true.

Impact

While claimPeriodActive is a view function, it is called in :

• VaultControllerStrategy::withdraw, which reverts if !fundFlowController.claimPeriodActive().

• VaultControllerStrategy::getMinDeposits, which returns the minimum amount of tokens that must remain in this strategy.

This logic flaw leads to the following situations : VaultControllerStrategy::withdraw will always revert, because !fundFlowController.claimPeriodActive() will always be true, and VaultControllerStrategy::getMinDeposits will always return totalDeposits, preventing the unbounding of tokens from the vaults.

PoC

The following hardhat test can be added in the file test/linkStaking/fund-flow-controller.test.ts and run using npx hardhat test --grep "fundflowcontroller claimperiodactive is never true"

Tools Used

Manual review.

Recommendations

To resolve this issue, update the timeOfLastUpdateByGroup variable in FundFlowController::updateVaultGroups so that it correctly tracks the next unbonded group :