Liquid Staking

Summary

In the StakingPool::_updateStrategyRewards function, rewards and fees are distributed based on changes in strategy balances since the last update. However, the function incorrectly treats dynamic arrays as fixed arrays without setting their lengths, leading to persistent reverts during execution. This results in the inability to update strategy rewards, effectively causing a self-induced Denial of Service (DoS) for the protocol.

Vulnerability Details

The function StakingPool::_updateStrategyRewards distributes rewards by calculating balance changes in different strategies. The problem arises in the way dynamic arrays, receivers and feeAmounts, are instantiated and treated later in the function. Initially, these arrays are instantiated as dynamic arrays of fixed-length arrays, but later, they are manipulated as if they were fixed arrays, which leads to reverts.

The issue can be observed in the following incorrect implementation:

This results in an error like:

The correct implementation should define the arrays as fixed-length arrays from the start:

Failing to handle the arrays correctly results in the function persistently reverting, preventing the protocol from updating strategy rewards.

Impact

This vulnerability effectively causes a self-induced Denial of Service (DoS) in the protocol. If the function cannot execute properly, strategy rewards and fees will no longer be calculated or distributed, severely impacting the functionality of the staking pool.

Tools Used

Manual

Recommendations

Ensure that the arrays are properly initialized with fixed lengths from the start, or modify the function to handle dynamic arrays correctly when setting values.