Liquid Staking

Summary

The function PriorityPool::canWithdraw incorrectly calculates withdrawal amounts when the contract is paused. Although canUnqueue is set to zero when the contract is paused to prevent users from unqueuing tokens, the logic still subtracts canUnqueue from totalQueued. This results in an inflated withdrawal limit because the totalQueued pool expands to offset the intended restriction of canUnqueue, effectively bypassing the pause condition. As a result, users can withdraw more tokens than intended, even when the contract is paused.

Vulnerability Details

The vulnerability stems from the calculation of stLINKCanWithdraw within PriorityPool::canWithdraw. When the contract is paused, the protocol correctly sets canUnqueue to zero to prevent users from unqueuing tokens:

However, in the next calculation, canUnqueue is subtracted from totalQueued, and this altered value is used to calculate stLINKCanWithdraw:

When canUnqueue is zero, the subtraction from totalQueued artificially increases the effective withdrawal limit. This negates the intention of the paused() condition, as the very tokens that should be restricted from being unqueued are still indirectly available for withdrawal by being included in totalQueued.

You can view the relevant code here:

• canWithdraw implementation in PriorityPool

• performUpkeep call in WithdrawalPool

Impact

This issue compromises the protocol's ability to enforce the paused state during critical situations. By allowing withdrawals even when unqueuing is restricted, the protocol risks moving more tokens than it should, leading to potential security vulnerabilities. This flaw can disrupt the balance of queued tokens and affect the accuracy of off-chain systems that rely on the contract's state for updates, such as PriorityPool::updateDistribution. Since PriorityPool::canWithdraw is also used by WithdrawalPool::performUpkeep to determine how many tokens to move, bypassing the pause restrictions undermines the protocol's safeguards and stability mechanisms.

Tools Used

Manual