Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of access control modifier on the PriorityPool#`performUpkeep()`, which allow `anyone` to call the PriorityPool#`performUpkeep()`

0xmuxyz

Summary

Lack of access control modifier on the PriorityPool#performUpkeep(), which allow anyone to call the PriorityPool#performUpkeep().

Vulnerability Details

According to the Chainlink documentation, the performUpkeep() is supposed to be called by Chainlink Network (Chainlink Keeper).

However, within the PriorityPool#performUpkeep(), there is no access control modifier like this:
https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/PriorityPool.sol#L437

@> function performUpkeep(bytes calldata _performData) external {
bytes[] memory depositData = abi.decode(_performData, (bytes[]));
_depositQueuedTokens(queueDepositMin, queueDepositMax, depositData);
}

Also, within the LSTRewardsSplitter#performUpkeep(), there is also no access control modifier like this:
https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L101

@> function performUpkeep(bytes calldata) external {
int256 newRewards = int256(lst.balanceOf(address(this))) - int256(principalDeposits);
if (newRewards < 0) {
principalDeposits -= uint256(-1 * newRewards);
} else if (uint256(newRewards) < controller.rewardThreshold()) {
revert InsufficientRewards();
} else {
_splitRewards(uint256(newRewards));
}
}

Impact

This allow anyone to be able to call the PriorityPool#performUpkeep() and the LSTRewardsSplitter#splitRewards() anytime they want, which is unexpected situation for this protocol design.

Tools Used

Manual review

Recommendations

Within both the PriorityPool#performUpkeep() and the LSTRewardsSplitter#performUpkeep(), consider adding an access control modifier (i.e. onlyKeeper modifier) in order only Chainlink Keeper to be able to call the both functions.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.