Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

isremoved defaults or is hardcoded to false

kwakudr

Summary

isremoved in the vault contract defaults or is hardcoded to false. This is the root cause. This is called in other functions to determine the list of active vaults.

Vulnerability Details

/**
* @notice Returns whether the operator for this vault has been removed from the Chainlink staking contract
* @dev only used by operator vaults but defined here to keep interface consistent
* @return true if operator has been removed, false otherwise
*/
function isRemoved() public view virtual returns (bool) {
return false;
}
function queueVaultRemoval(uint256 _index) external {
address vault = address(vaults[_index]);
​
​
if (!IVault(vault).isRemoved()) revert OperatorNotRemoved();
for (uint256 i = 0; i < vaultsToRemove.length; ++i) {
if (vaultsToRemove[i] == vault) revert VaultRemovalAlreadyQueued();
}
​
​
vaultsToRemove.push(address(vaults[_index]));
​
​
// update group accounting if vault is part of a group
function _getTotalDepositRoom(
address[] memory _vaults,
uint256 _numVaultGroups,
uint256 _vaultGroup,
uint256 _vaultMaxDeposits,
uint256 _depositIndex
) internal view returns (uint256, uint256[] memory) {
uint256 totalDepositRoom;
uint256 numNonEmptyVaults;
uint256[] memory nonEmptyVaults = new uint256[]();
​
​
for (uint256 i = _vaultGroup; i < _depositIndex; i += _numVaultGroups) {
if (IVault(_vaults[i]).isRemoved()) continue;
​
​
uint256 principalDeposits = IVault(_vaults[i]).getPrincipalDeposits();
totalDepositRoom += _vaultMaxDeposits - principalDeposits;
if (principalDeposits != 0) {
nonEmptyVaults[numNonEmptyVaults] = i;
numNonEmptyVaults++;
}
}

A vault could be removed but the system would show that it still exist which is not intended. /**
* @notice Queues a vault for removal
* @dev a vault can only be queued for removal if the operator has been removed from the
* Chainlink staking contract
* @param _index index of vault
*/

Vaults will never be removed from the queue which throws off the sequence of the vaults.

Impact

Code will revert in some cases when it should continue

Tools Used

manual review

Recommendations

remove the default false and let it toggle between the boolean true or false when the vault is removed or not.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.