Liquid Staking

Summary

The perform upkeep tries to distubute the rewards to all the fee receivers that return true from the checkUpKeep call, but the performUpKeep can also be called directly on the specific splitter, which will lead to reverts, and the performUpKeep cannot be succeeded.

Vulnerability Details

To split the rewards, first we need to confirm that the rewards can be split; for this we call checkUpkeep.

if it returns true then we will call the performUpKeep function, which will call LSTRewardsSplitter:performUpKeep and split the rewards in fee receiver.

The PerformUpkeep function of LSTRewardsSplitter checks that the total lst balance and pricnipal deposit is more than the rewards threshold, then calls the _splitRewards function, which distributes the fee to the fee receiver and updates the principalDeposits=lst.balanceOf(address(this)).

POC:

1. The keeper calls the checkupKeep and receives true for the overall split and with the 4 splitter.

2. Keeper submits the transaction for performUpKeep for these 4 splitters.

3. Bob monitors the transaction and frontruns the Keeper transaction and performUpkeep on one of the splitters.

4. When the execution node picks the Keeper transaction, it will be reverted with this message: InsufficientRewards.

Impact

The keeper transaction will be frontrun by malicious users and will result in DoS for keeper.

Tools Used

Manual Review

Recommendations

Remove the revert condition and simply return it, no rewards to split.