Liquid Staking

Summary

The function lack proper access control modifiers, allowing any external user to call them. This is the root issue

Vulnerability Details

The function lack proper access control modifiers, allowing any external user to call them. depositQueuedTokens is marked as external without any access restrictions.

Malicious actors could manipulate deposits, trigger undesired operations, or disrupt the pool's functionality. Unrestricted access to critical functions could lead to fund mismanagement or exploitation.

Bypassing stored deposit limits could lead to inconsistencies between the contract's stated rules and its actual behavior, potentially breaking assumptions made by other parts of the system or by users. An attacker could potentially pass a very large array, causing the transaction to hit the block gas limit and fail.

Impact

DOS is one of the possible attacks for this function.

Tools Used

Manual Review

Recommendations

Apply appropriate access control modifiers (onlyOwner, onlyDistributionOracle, etc.) to functions that should be limited to specific roles.