Liquid Staking

Summary

In the Chainlink RewardVault, a malicious user can exploit the CommunityVCS::claimRewards function to continuously claim rewards on behalf of any vault, even with minimal accrued rewards. This prevents the rewards from compounding, disrupting the proper accrual process for legitimate users and vaults, which relies on the accumulation of unclaimed rewards.

Vulnerability Details

The claimReward() function in the Chainlink RewardVault contract allows users' rewards to compound over time. As unclaimed rewards accrue, they grow based on the staker’s principal and the reward per token, including a multiplier effect. The greater the accrued rewards, the larger the multiplier applied, resulting in a greater overall reward when eventually claimed.

The above is the implement of the claimReward() function in Chainlink RewardVault contract with "@audit" comments explaining every code line. Take note of the multiplier effect. The smaller the accrued reward been multiplied, the smaller the overall claimed reward.

However, in the CommunityVCS::claimRewards function, a malicious user can repeatedly call the function with an arbitrary _minRewards parameter, triggering the claim of rewards on behalf of any vault, regardless of how small the accrued reward is. The relevant code is as follows:

This enables an attacker, even one not participating in the StakeLink protocol, to grief the system by repeatedly claiming small amounts of rewards. As a result, vaults lose the benefit of compounded rewards, reducing the potential payouts for legitimate users.

Impact

This attack prevents vaults from accruing rewards over time, leading to significantly smaller reward claims due to the reduced multiplier effect. The protocol and its users are left vulnerable to this griefing attack, where an external actor can repeatedly claim small amounts of rewards, effectively preventing meaningful accrual.

Tools Used

Manual

Recommendations

Introduce a minimum claim threshold or restrict the ability to call CommunityVCS::claimRewards to legitimate protocol participants. Alternatively, impose limits on the frequency of reward claims or ensure the rewards accrued reach a meaningful amount before allowing a claim to be processed.