Liquid Staking

Summary

Depositing in stakingPool with different _data length to strategies arrays lengths will revert the deposit.

Vulnerability Details

In stakingPool.sol when priority pools calls deposit function, if user passes the _data array which is less than the strategies length and then while accessing _data[_data.length] we will get index out of bound error. This will eventually fail the transaction

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L477

1. suppose there are 3 strategies and user passes _data[] array of length 2 to deposit

2. the transaction will fail with the index out of bound error while accessing _data[2] if the first two strategies are filled in _depositLiquidity function

Impact

The transaction will get failed with index out of bound error. if strategies length if greater than _data[] and if first strategies are filled already

Tools Used

Manual Inspection

Recommendations

add this below check