Liquid Staking

Summary

The FundFlowController contract uses the claimPeriod variable to track the duration of the unbonding period for vault groups in the Chainlink staking contract. However, if Chainlink updates its claimPeriod, the FundFlowController will become out of sync, as there is no mechanism to update this value in the contract. This discrepancy can cause operational issues, such as failed withdrawals or deposits, because the claimPeriod will no longer align with the updated Chainlink staking contract.

Vulnerability Details

The claimPeriod variable is set during the initialization of the FundFlowController contract:

If Chainlink updates the claimPeriod in its staking contract, the FundFlowController will continue using the outdated value, which could result in misaligned claim and unbonding period calculations. Without the ability to update the claimPeriod, the contract will cause deposits and withdrawals to fail unpredictably when it attempts to execute operations that rely on the outdated period.

Impact

If the claimPeriod is out of sync with the Chainlink staking contract, the protocol will not be able to correctly execute unbondings or claim operations. This misalignment could lead to failed transactions and result in unpredictable reverts during withdrawals and deposits. Such issues can disrupt the normal operations of the protocol and degrade user confidence.

Tools Used

Manual

Recommendations

Implement a function in the FundFlowController contract that allows the claimPeriod to be updated dynamically in case of changes to the Chainlink staking contract. This will ensure that the protocol remains aligned with the current staking parameters and avoids operational misalignment.