Liquid Staking

Summary

The StakingPool::transferShares function emits incorrect event data by recording the stake equivalent of the shares transferred, rather than the actual shares. This discrepancy can lead to misleading information in the logs, which can negatively affect users and systems that depend on the event data, such as analytics platforms.

Vulnerability Details

The StakingPool::transferShares function transfers shares from one user to another by invoking the internal function _transferShares. However, after the transfer occurs, the Transfer event emits the stake equivalent of the shares instead of the actual share amount. This inconsistency can create confusion for users and external systems that rely on the event logs for accurate tracking.

The relevant part of the function is as follows:

In this code, the Transfer event emits the result of getStakeByShares(_sharesAmount) instead of the actual _sharesAmount, leading to discrepancies in the data emitted.

Impact

This issue results in incorrect data being logged by the contract, which could mislead users and external systems such as Dune Analytics or similar platforms that track contract's activities from their logs. The event does not accurately reflect the actual shares transferred.

Tools Used

Manual

Recommendations

Update the Transfer event to emit the actual shares transferred instead of the stake equivalent. This will ensure that the data accurately reflects the transaction details.