Summary

The stake function in the VaultRouterBranch contract does not verify the actual number of tokens transferred, leading to potential discrepancies in staked shares if the indexToken has transfer fees or non-standard behaviors.

The stake function records the full amount of shares as staked without verifying that the safeTransferFrom call actually transferred the intended number of tokens. If the indexToken implements a fee on transfer or alters the amount received, the contract's internal accounting for staked shares will not reflect the actual tokens received. This mismatch can lead to inconsistencies, allowing attackers to manipulate their staked share balance relative to the actual tokens held by the contract. This breaks the security guarantee of accurate accounting, as the contract assumes that the number of tokens transferred matches the number of shares recorded.

Impact

The impact is significant because it can lead to inaccurate accounting of staked shares. This discrepancy can be exploited by attackers to manipulate their staked share balance, potentially leading to unauthorized rewards or affecting the distribution of staking rewards. The financial integrity of the staking mechanism is compromised, as the actual tokens held by the contract may not match the recorded staked shares. But it also depends on whether the indexToken implements transfer fees or non-standard behaviors. If such tokens are used, the risk is higher, as the discrepancy between transferred tokens and recorded shares becomes more pronounced.

Tools Used

manual review

An attacker can exploit this vulnerability by staking tokens with transfer fees:

1. Assume a Token with Transfer Fees:

• The indexToken charges a 1% fee on transfers.

2. Staking Tokens:

• The attacker calls the stake function with 1000 shares.

• The safeTransferFrom call transfers only 990 tokens due to the 1% fee.

3.Discrepancy in Accounting:

• The contract records 1000 shares as staked, but only 990 tokens are actually received.

• The attacker effectively stakes fewer tokens than recorded, potentially gaining an advantage in reward distribution.

Recommendations

Implement a check to verify the actual number of tokens transferred by safeTransferFrom and adjust the internal accounting accordingly.