Ethena Labs - Noro's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L21

Vulnerability details

According to EIP-4626 :

maxDeposit :

MUST factor in both global and user-specific limits, like if deposits are entirely disabled (even temporarily) it MUST return 0.

maxMint:

MUST factor in both global and user-specific limits, like if mints are entirely disabled (even temporarily) it MUST return 0.

maxWithdraw :

MUST factor in both global and user-specific limits, like if withdrawals are entirely disabled (even temporarily) it MUST return 0.

and maxRedeem :

MUST factor in both global and user-specific limits, like if redemption is entirely disabled (even temporarily) it MUST return 0.

However, in the implementation maxDeposit and maxMint does not return 0 when depositor or minter is SOFT_RESTRICTED_STAKER_ROLE, and maxWithdraw and maxRedeem also doesn’t return 0 when owner of tokens to be withdrawn or redeemed is FULL_RESTRICTED_STAKER_ROLE .

Impact

this breaks external composability with other projects .

Tools Used

Manual review

Recommended Mitigation Steps

• override ERC4626 implementation maxDeposit and maxMint functions and check if depositor or minter is SOFT_RESTRICTED_STAKER_ROLE and return 0 if so .
• override ERC4626 implementation maxWithdraw and maxRedeem functions and check if the owner is FULL_RESTRICTED_STAKER_ROLE and return 0 if so .

Assessed type

ERC4626