Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect update for state variable `sharesSinceLastUpdate` in contract `PriorityPool`

trtrth

Summary

In flow of deposit queued tokens into staking pool, the state variable sharesSinceLastUpdate is improperly updated due to wrong implementation

Vulnerability Details

The internal function PriorityPool#_depositQueuedTokens implements logic to deposit queued tokens into staking pool. The logic also updates state variables if there is deposit from queued tokens, specifically totalQueued changes. If the case happens, sharesSinceLastUpdate is added by an amount equals to stakingPool.getSharesByStake(diff). However, the amount stakingPool.getSharesByStake(diff) is the amount of share calculated with contract state after stakingPool.deposit(address(this), toDepositFromQueue, _data), meanwhile the actual amount minted for the deposit is calculated by the contract state before stakingPool.deposit(address(this), toDepositFromQueue, _data) is executed

function _depositQueuedTokens(
uint256 _depositMin,
uint256 _depositMax,
bytes[] memory _data
) internal {
if (poolStatus != PoolStatus.OPEN) revert DepositsDisabled();
​
uint256 strategyDepositRoom = stakingPool.getStrategyDepositRoom();
if (strategyDepositRoom == 0 || strategyDepositRoom < _depositMin)
revert InsufficientDepositRoom();
​
uint256 _totalQueued = totalQueued;
uint256 unusedDeposits = stakingPool.getUnusedDeposits();
uint256 canDeposit = _totalQueued + unusedDeposits;
if (canDeposit == 0 || canDeposit < _depositMin) revert InsufficientQueuedTokens();
​
uint256 toDepositFromStakingPool = MathUpgradeable.min(
MathUpgradeable.min(unusedDeposits, strategyDepositRoom),
_depositMax
);
​
uint256 toDepositFromQueue = MathUpgradeable.min(
MathUpgradeable.min(_totalQueued, strategyDepositRoom - toDepositFromStakingPool),
_depositMax - toDepositFromStakingPool
);
​
@> stakingPool.deposit(address(this), toDepositFromQueue, _data);
_totalQueued -= toDepositFromQueue;
​
@> if (_totalQueued != totalQueued) {
uint256 diff = totalQueued - _totalQueued;
depositsSinceLastUpdate += diff;
@> sharesSinceLastUpdate += stakingPool.getSharesByStake(diff);
totalQueued = _totalQueued;
}
​
emit DepositTokens(toDepositFromStakingPool, toDepositFromQueue);
}

Impact

Offchain calculation for the distributions can be incorrect due to the wrongly tracked amount sharesSinceLastUpdate. This calculation can effectively affect protocol's funds in distribution flow

Tools Used

Manual

Recommendations

Update the order of the contract calls

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`sharesShinceLastUpdate` is not properly updated in PriorityPool

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.