Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Updating strategy rewards can lower the `totalStaked` variable incorrectly

demorextess

Summary

Updating strategy rewards can lower the totalStaked variable incorrectly

Vulnerability Details

This vulnerability arise in _updateStrategyRewards() function staking pool contract. This function checks all the strategies and calculate the deposit changes and then calculate the reward amount. But this amount can be lower than zero because it's calculated in following way:

function getDepositChange() public view virtual returns (int) {
uint256 totalBalance = token.balanceOf(address(this));
for (uint256 i = 0; i < vaults.length; ++i) {
totalBalance += vaults[i].getTotalDeposits();
}
return int(totalBalance) - int(totalDeposits);
}

In _updateStrategyRewards()function even the funds aren't sent through another contract the total staked number can be changed due to wrong execution logic.

// sum up rewards and fees across strategies
for (uint256 i = 0; i < _strategyIdxs.length; ++i) {
IStrategy strategy = IStrategy(strategies[_strategyIdxs[i]]);
​
(
int256 depositChange,
address[] memory strategyReceivers,
uint256[] memory strategyFeeAmounts
) = strategy.updateDeposits(_data);
totalRewards += depositChange;
​
if (strategyReceivers.length != 0) {
receivers[i] = strategyReceivers;
feeAmounts[i] = strategyFeeAmounts;
totalFeeCount += receivers[i].length;
for (uint256 j = 0; j < strategyReceivers.length; ++j) {
totalFeeAmounts += strategyFeeAmounts[j];
}
}
}
​
// update totalStaked if there was a net change in deposits
if (totalRewards != 0) { // @audit if totalRewards is lower than zero total staked will be decreased which will cause insolvency
&> totalStaked = uint256(int256(totalStaked) + totalRewards);
}

Impact

totalStakednumber will be affected and it will be lowered even the funds ( LINK tokens ) aren't send through another contract. This will cause loss of funds because the price of the shares will be dropped after this wrong execution.

Tools Used

Manual review

Recommendations

Update the totalStakednumber only whenever the rewards is higher than 0

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.