Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lacking access control in LSTRewardsSplitter contract's performUpkeep() function

zoobopukeman

Summary

Lacking proper access control in LSTRewardsSplitter contract's performUpkeep() function can lead into corrupting system's states.

Audited scope:

  • 2024-09-stakelink/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol

Vulnerability Details

  1. Calling LSTRewardsSplitter contract's performUpkeep()

// 2024-09-stakelink/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol
function performUpkeep(bytes calldata) external {

There is no explicit indication that above functions are protected by any access control.

Impact

Anyone can call this function directly to run internal processing, posing a significant security threat to the integrity and functionality of your system.

Recommended Mitigation

Apply onlyChainlink modifier (that checks caller address is from Chainlink nodes) to restrict access:

// 2024-09-stakelink/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol
function performUpkeep(bytes calldata) external onlyChainlink {
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.