Liquid Staking

Summary

The FundFlowController::updateVaultGroups function is responsible for managing vault group updates and ensuring that vaults move into their claiming periods at the correct time. However, the function relies on users to call it on time, and there is no built-in incentive or "dedicated" protocol-run keeper to ensure timely execution. If the function is not called on time, the available window for the claiming period can be shortened or missed entirely, reducing the protocol's efficiency. Without an incentive or automation, the protocol risks losing optimal performance due to the misalignment of vault unbonding and claiming periods.

Vulnerability Details

When FundFlowController::updateVaultGroups is called, it performs the following key operations:

1. Re-unbonds all vaults in the current vault group, preparing them to be in their claiming period when the curUnbondedVaultGroup rotates back to it.

2. Increments curUnbondedVaultGroup to the next vault group in the list.

The function depends on external users to call it at the correct time. If this does not happen, the vault group that should be moved into the claiming period may miss its window, reducing the time available to claim tokens once it is finally set as the curUnbondedVaultGroup.

Here is the relevant portion of the function:

Without timely execution, the function may be delayed, causing the next unbonded vault group to enter its claiming period later than intended. This shortens the window of time for claiming rewards, leading to inefficiencies and missed opportunities for users to interact with the protocol.

There is no protocol-run keeper mechanism for this function or incentive system in place to encourage users to call updateVaultGroups on time. The absence of such mechanisms leads to reliance on user goodwill, which can be unreliable.

Impact

Delays in calling updateVaultGroups can shorten or completely miss the claiming period for vault groups, resulting in missed opportunities for users to claim rewards. This affects the efficiency of the protocol and could lead to reduced user satisfaction and performance issues.

Tools Used

Manual

Recommendations

1. Implement a Keeper Mechanism: Introduce a protocol-run keeper system to automatically call updateVaultGroups at the correct time, ensuring vault updates are always timely and optimal.

2. Incentivize Users: Provide users with an incentive (e.g., gas reimbursement or reward tokens) to call the function on time, encouraging timely execution.