Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

there is not guaranty that `OperatorVault::updateDeposits` must be called before calling`OperatorVault::exitVault` function

unique

Summary

according to the OperatorVault::exitVault comment updateDepositsfunction should be called before the exitvaultfunction but the code does not enforce a mandatory call to updateDeposits before exitVault

Vulnerability Details

/**
* @notice Withdraws tokens from the Chainlink staking contract and sends them to the vault controller
@>> * @dev updateDeposits must be called before calling this function
* @dev used to withdraw remaining principal and rewards after operator has been removed
* @dev will also send any unclaimed operator rewards to rewards receiver
* @return total principal withdrawn
* @return total rewards withdrawn
*/
function exitVault() external onlyVaultController returns (uint256, uint256) {
if (!isRemoved()) revert OperatorNotRemoved();
​
uint256 opRewards = getUnclaimedRewards();
if (opRewards != 0) _withdrawRewards();
​
uint256 rewards = getRewards();
if (rewards != 0) rewardsController.claimReward();
​
uint256 principal = getPrincipalDeposits();
stakeController.unstakeRemovedPrincipal();
​
uint256 balance = token.balanceOf(address(this));
token.safeTransfer(vaultController, balance);
​
return (principal, rewards);
}
​
/**
* @notice Sets the operator address if not already set
* @dev only used for original vaults that are already deployed and don't have an operator set
* @param _operator operator address
*/
function setOperator(address _operator) public onlyOwner {
if (operator != address(0)) revert OperatorAlreadySet();
if (_operator == address(0)) revert ZeroAddress();
operator = _operator;
}
​

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/linkStaking/OperatorVault.sol#L219

Impact

updateDeposits recalculates the total deposits and operator rewards before attempting to exit. Without this update, the contract might work with outdated deposit and reward values, leading to incorrect withdrawals and potential discrepancies in the final transfer of funds.

Tools Used

Recommendations

To ensure that updateDeposits is called before exitVault, add a mechanism to verify this, such as storing a timestamp or flag when updateDeposits is called and checked before allowing the exitVault function to execute. Here’s how you could do that:

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

[INVALID] `exitVault` doesn't call `updateDeposits` before calling `_withdrawRewards` in the vault removal process

Appeal created

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[INVALID] `exitVault` doesn't call `updateDeposits` before calling `_withdrawRewards` in the vault removal process

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.