Liquid Staking

Summary

The OperatorVCS::queueVaultRemoval function lacks proper access control, allowing anyone to queue and remove vaults from the protocol. This is a highly sensitive function that affects the core operations of the protocol, including its ability to manage staking and rewards. An attacker can exploit this vulnerability by arbitrarily removing vaults, obstructing the protocol's normal functioning and disrupting its services for users.

Vulnerability Details

The OperatorVCS::queueVaultRemoval function allows any external caller to queue a vault for removal without any restrictions or access controls:

The function performs sensitive operations, such as queuing vaults for removal and updating group accounting. If an attacker calls this function, they can arbitrarily queue vaults for removal and potentially invoke the removeVault function. This lack of access control opens up the possibility for malicious actors to repeatedly remove vaults, severely obstructing the protocol's operations.

Without access control, the protocol is vulnerable to an attack where vaults are continually removed, preventing StakeLink from fulfilling its core service—managing staking and providing rewards to users.

Impact

An attacker can disrupt the core operations of StakeLink by removing vaults from the system, effectively rendering the protocol unable to provide its services to users. This would obstruct staking, disrupt reward distributions, and cause significant financial and operational damage to the protocol and its users.

Tools Used

Manual

Recommendations

Implement strict access control to ensure that only authorized entities, such as protocol administrators, can call queueVaultRemoval and removeVault.