Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Queued withdrawers can not withdraw funds due to owner mistake

trtrth

Summary

The queued withdrawers potentially can not withdraw queued assets if the owner calls PriorityPool#setWithdrawalPool() improperly.

Vulnerability Details

The function PriorityPool#setWithdrawalPool() allows owner to update withdrawalPool address without enforcing all queued withdrawals are finalized. This could potentially cause queued withdrawers can not withdraw funds if the owner change the withdrawalPool address without checking the queued withdrawals fully finalized or not.
After withdrawal pool address is updated, the queued withdrawals in the old withdrawal pool can not be finalized through either functions WithdrawalPool#deposit() or WithdrawalPool#performUpkeep().
So the queued withdrawers can not withdraw funds because queued withdrawals in the old withdrawalPool are not finalized

function setWithdrawalPool(address _withdrawalPool) external onlyOwner {
// not enforce all queued withdrawals are finalized
​
if (address(withdrawalPool) != address(0)) {
IERC20Upgradeable(address(stakingPool)).safeApprove(address(withdrawalPool), 0);
token.safeApprove(address(withdrawalPool), 0);
}
​
IERC20Upgradeable(address(stakingPool)).safeApprove(_withdrawalPool, type(uint256).max);
token.safeApprove(_withdrawalPool, type(uint256).max);
​
withdrawalPool = IWithdrawalPool(_withdrawalPool);
}

PoC

Add the test below to the test file priority-pool.test.ts

it.only('set new withdrawalPool does not enforce all queued withdrawals finalized', async () => {
const { adrs, pp, token, stakingPool, strategy, withdrawalPool, accounts } = await loadFixture(
deployFixture
)
​
await stakingPool.approve(adrs.pp, ethers.MaxUint256)
await pp.deposit(toEther(100), true, ['0x'])
await pp.withdraw(toEther(50), 0, 0, [], true, true)
await strategy.setMinDeposits(0)
await pp.withdraw(toEther(10), 0, 0, [], true, true)
​
assert.equal(fromEther(await stakingPool.balanceOf(adrs.withdrawalPool)), 60)
assert.equal(fromEther(await withdrawalPool.getTotalQueuedWithdrawals()), 60)
assert.equal(fromEther(await token.balanceOf(adrs.withdrawalPool)), 0)
​
await pp.setWithdrawalPool(accounts[1]);
​
// Queued withdrawals still there
assert.equal(fromEther(await withdrawalPool.getTotalQueuedWithdrawals()), 60)
​
// call performUpkeep to finalize queued withdrawals
// FAIL
await expect(
withdrawalPool.performUpkeep(
ethers.AbiCoder.defaultAbiCoder().encode(['bytes[]'], [['0x']])
)
).to.be.reverted
})

Impact

Queued withdrawers can not withdraw funds

Tools Used

Manual

Recommendations

Enforce queued withdrawals are finalized in the function setWithdrawalPool()

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!