Liquid Staking

Summary

The burn function in the StakingPool contract fails to update the totalStaked variable when tokens are burned, leading to an inconsistency between totalStaked and the actual total staked amount. Can result in incorrect calculations, difficulty in reconciling balances, and potential exploits.

Vulnerability Details

• When users stake tokens using the deposit function, the totalStaked variable is correctly incremented by the deposited amount: https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L120-L124

• However, when users burn their staked tokens using the burn function, the totalStaked variable is not decremented: https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L423-L426

The issue arises because the burn function calls the internal _burn function to burn the tokens from the user's balance, but it does not decrease the totalStaked amount accordingly. As a result, the totalStaked variable becomes out of sync with the real total staked amount. https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L423-L426

This inconsistency can lead to incorrect calculations and unexpected behavior in other parts of the contract that rely on the accuracy of totalStaked.

Burden of Proof

Consider the following scenario

1. Initially, totalStaked is 0.

2. A user calls the deposit function to stake 100 tokens. The totalStaked variable is correctly incremented to 100.

3. The same user then calls the burn function to burn 50 tokens.

4. After the burn function is executed, the totalStaked variable remains at 100, even though the actual total staked amount has decreased to 50.

The discrepancy between the totalStaked value and the actual total staked amount proves that the burn function does not properly update totalStaked.

Impact

Users and contract administrators may face challenges when trying to reconcile the actual staked balances with the totalStaked value, as they will not match.

Tools Used

Vs

Recommendations

By decrementing totalStaked by the _amount being burned, the contract ensures that totalStaked remains in sync with the actual total staked amount.