Ethena Labs - Cosine's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L225-L238

Vulnerability details

Summary

As the docs state out, the soft restricted role should not be able to deposit and withdraw in the staker contracts, as this would be an illegal action. But a missing check inside StakedUSDe allows soft restricted users to withdraw.

Vulnerability Details

Here is a quote of the docs about the SOFT_RESTRICTED_STAKER_ROLE: “Due to legal requirements, there's a SOFT_RESTRICTED_STAKER_ROLE and FULL_RESTRICTED_STAKER_ROLE. The former is for addresses based in countries we are not allowed to provide yield to, for example USA. Addresses under this category will be soft restricted. They cannot deposit USDe to get stUSDe or withdraw stUSDe for USDe.”

Therefore, it should not be allowed that users who are soft restricted are able to withdraw, but as we can see in the withdraw function only full restricted users are prevented from withdrawing:

function _withdraw(address caller, address receiver, address _owner, uint256 assets, uint256 shares)
  internal
  override
  nonReentrant
  notZero(assets)
  notZero(shares)
{
  if (hasRole(FULL_RESTRICTED_STAKER_ROLE, caller) || hasRole(FULL_RESTRICTED_STAKER_ROLE, receiver)) {
    revert OperationNotAllowed();
  }

  super._withdraw(caller, receiver, _owner, assets, shares);
  _checkMinShares();
}

Impact

Soft restricted users are able to withdraw, which is an illegal action, as the docs state out.

Tools Used

Manual Review

Recommendations

Implement a check so that soft restricted users are not able to withdraw.

Assessed type

Access Control