Liquid Staking

Summary

The withdrawal function contains a vulnerability in its logic that can result in completely emptying a vault, even when it violates the protocol's intended minimum deposit requirement. Specifically, when the remaining balance in a vault after a partial withdrawal would be less than the minDeposits threshold, the function is currently programmed to empty the vault rather than maintaining the minimum balance.
https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L140

Vulnerability Details

The condition is intended to prevent leaving a vault with less than minDeposits. However, rather than withdrawing an amount that would preserve the minimum deposit, the function opts to completely empty the vault by withdrawing all remaining tokens.
This leads to situations where vaults, which are supposed to maintain a minimum balance, are left with zero funds, violating the contract's safety mechanism.

Impact

The vault becomes fully drained of its deposits, which can have several negative consequences:

1.Reduced Liquidity: Vaults are designed to maintain a minimum level of liquidity to ensure that they can participate in staking, yield farming, or other activities. By depleting the vault, you reduce the system's liquidity and effectiveness.
2.Potential Financial Losses: A completely emptied vault could lead to missed opportunities for generating yield or rewards, as the vault would no longer have sufficient funds to participate in the protocol's strategies.
3.Protocol Instability: If multiple vaults are drained due to this logic, it could lead to larger protocol-wide issues, such as insufficient collateral backing or the inability to handle large-scale withdrawals, which could lead to debt spirals or even liquidation risks.
the impact of any of these scenarios is critical.

Tools Used

Manual code review

Recommendations

Break the loop directly in this case
Break the loop directly in this case