Liquid Staking

Summary

The StakingPool contract enforces a limit where the sum of all fees (_totalFeesBasisPoints) cannot exceed 4000 basis points, while the OperatorVCS contract enforces a maximum of 3000 basis points. This disparity in fee validation between the two contracts can cause issues with fee distribution, especially when calculating rewards across multiple strategies. When StakingPool::_updateStrategyRewards is called, the difference in fee basis points can result in insufficient funds to properly pay all fee receivers.

Vulnerability Details

The StakingPool contract, upon deployment, ensures that the total sum of fees (_totalFeesBasisPoints) does not exceed 4000 basis points (or 40%). Conversely, the OperatorVCS contract limits the total sum of fees to 3000 basis points (or 30%). This difference can lead to accounting issues when rewards are distributed.

When StakingPool::_updateStrategyRewards() is called, the contract first triggers the updateDeposits function in all linked strategies, including OperatorVCS. Inside OperatorVCS::updateDeposits, the fees are calculated based on the fee receivers’ basis points:

In StakingPool::_updateStrategyRewards, these fee amounts are summed up to calculate the totalFeeAmounts to be distributed among all fee receivers. However, due to the differing _totalFeesBasisPoints between StakingPool (4000) and OperatorVCS (3000), the rewards available for distribution may fall short of the total required to satisfy all the fee receivers.

Impact

The mismatch in _totalFeesBasisPoints between StakingPool and OperatorVCS can result in insufficient fees being available to distribute to fee receivers. This could lead to unfair or incomplete reward distributions, undermining the accuracy and fairness of the protocol's reward system.

Tools Used

Manual

Recommendations

Ensure that the _totalFeesBasisPoints is consistent across both StakingPool and OperatorVCS to avoid discrepancies during fee distribution. Additionally, consider implementing logic that handles scenarios where the fees to be distributed exceed the total available rewards, ensuring a fair distribution across all receivers.