Liquid Staking

Summary

StakingPool contract's updateFee function does not call _updateStrategyRewards before modifying the fee structure.
This omission can lead to incorrect fee calculations and distributions, resulting in users not receiving the fees they were entitled to under the previous fee structure.

Vulnerability Details

The StakingPool contract manages staking operations, including the distribution of fees to users and fee receivers. The contract allows the owner to update fees through the updateFee function.

However, when fees are updated, the function does not call _updateStrategyRewards to settle any pending rewards and fees before the change. This can lead to incorrect fee distributions, as the pending rewards are calculated using the new fee structure rather than the one in effect when the rewards were accrued.

As can be seen, the new fee strructure overwrites the existing one which might cause loss of funds for the users if the fees are decreased.

Without calling _updateStrategyRewards before changing the fees, any pending rewards are calculated using the new fee structure instead of the one in place when the rewards were earned. Because he _updateStrategyRewards function calculates fees based on the current fees array.

You can see the concerned part in the function;

Impact

Incorrect fee distribution

Tools Used

Manual Review

Recommendations

Call _updateStrategyRewards before modifying fees