Liquid Staking

Summary

The OperatorVault::initialize function incorrectly handles the initialization process, particularly when the vaultController is already set. In this scenario, the protocol assumes that stakeController has also been initialized, and attempts to call the stakeController.migrate() function. However, since stakeController was never set, this results in an integration failure with the Chainlink protocol, which is critical for Stake Link's functionality.

Vulnerability Details

The OperatorVault::initialize function takes two initialization paths based on whether vaultController is set. The relevant code is as follows:

When vaultController != address(0), the else block is executed, which assumes that stakeController has already been set. The protocol attempts to call the stakeController.migrate() function, but this results in an error because stakeController was never initialized. The function does not provide any mechanism for setting the stakeController after deployment, leading to an incorrect integration with the Chainlink staking contract.

Since stakeController is supposed to represent the address of the Chainlink staking contract, its absence means that the protocol cannot communicate with Chainlink, a critical component for the Stake Link protocol’s operation.

Impact

The failure to properly initialize stakeController prevents the protocol from interacting with Chainlink’s staking contract. This breaks core functionality, as the protocol is unable to perform staking-related actions, severely impacting the operations of Stake Link. Without integration with Chainlink, the protocol cannot function as intended.

Tools Used

Manual

Recommendations

Ensure that stakeController is properly initialized in all cases, regardless of whether vaultController is set.