Frax Ether Liquid Staking contest - KIntern_NA's results

Lines of code

https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/frxETHMinter.sol#L131-L136

Vulnerability details

Impact

In case numDeposits > validators.length() function getNextValidator() will revert when i reach to validators.length() + 1

// url = https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/frxETHMinter.sol#L131-L136
(
    bytes memory pubKey,
    bytes memory withdrawalCredential,
    bytes memory signature,
    bytes32 depositDataRoot
) = getNextValidator(); // Will revert if there are not enough free validators

This case can happen cause maybe there are a lot of people want to stake their eth into this contract but there aren't enough depositContract for frxETHMinter to deposit user's eth to. ==> This will make user lose yield.

Tools Used

Manual review

Recommended Mitigation Steps

Break the loop when validators is empty.

[2022-09-frax] QA report

tags: c4, 2022-09-frax, QA

typo comments

• https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/frxETHMinter.sol#L78 recieved -> received

should check receiver != address(0)

• https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/sfrxETH.sol#L59-L71
• https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/sfrxETH.sol#L77

should use mix case for function name

• https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/ERC20/ERC20PermitPermissionedMint.sol#L53
• https://github.com/code-423n4/2022-09-frax/blob/55ea6b1ef3857a277e2f47d42029bc0f3d6f9173/src/ERC20/ERC20PermitPermissionedMint.sol#L59