Liquid Staking

Description

When a user calls the deposit() function, the internal _deposit() function is invoked. However, there is a critical issue in how the safeTransfer function is implemented, which mistakenly transfers tokens from the contract to the user, potentially allowing them to drain the contract's funds.

Impact

• Critical Loss of Funds: This line erroneously transfers the tokens (toDepositIntoQueue) to the user's address (_account) after depositing them into the withdrawal pool. The result is that the contract could double spend the tokens, transferring them to the user even though they should remain within the contract.

• Exploitation Risk: A malicious user could repeatedly call the deposit() function while there are queued withdrawals, continuously receiving free tokens from the contract. This can eventually deplete the contract’s funds, potentially leading to its insolvency.

Recommendations

1. Remove the Erroneous Transfer: The line where IERC20Upgradeable(address(stakingPool)).safeTransfer(_account, toDepositIntoQueue); is called should be removed. This line mistakenly transfers tokens to the user's account and should not exist.

   Instead, the tokens should only be deposited into the withdrawalPool as follows:

   withdrawalPool.deposit(toDepositIntoQueue);

   toDeposit -= toDepositIntoQueue;