Liquid Staking

Summary

he PriorityPool contract inherits from the Pausable contract, allowing critical contract functions to be paused during unexpected or malicious activities. However, there is a critical oversight in the implementation of the withdraw and claimLSDTokens functions. The whenNotPaused modifier, intended to prevent certain actions when the contract is paused, is not fully applied in these functions.

In the withdraw function, the whenNotPaused modifier is only applied when the condition shouldUnqueue == true is met. This creates a scenario where the contract can still be exploited even when it is paused, provided the malicious user gains access to stakeLink or receiptToken. Similarly, the whenNotPaused modifier is also missing in the claimLSDTokens function, allowing token claims to proceed even during paused states.

Vulnerability Details

The whenNotPaused modifier, which should restrict operations during paused states, is not applied consistently across all critical conditions. Specifically, in the withdraw function, if shouldUnqueue == false, the function bypasses the whenNotPaused protection, and the claimLSDTokens function entirely lacks this modifier.

Impact

Malicious users can withdraw tokens even when the contract is paused. If they gain access to the stakeLink or receiptToken, they can execute the withdrawal without being blocked by the pause functionality. This exposes the contract to potential exploits or unauthorized withdrawals during periods of critical operations or attacks.

Tools Used

Manual Review

Recommendations

Ensure that all critical functions are protected by the whenNotPaused modifier to prevent their execution when the contract is paused.