LSD Network - Stakehouse contest - SaeedAlipoor01988's results

A permissionless 3 pool liquid staking solution for Ethereum.

General Information

Platform: Code4rena

Start Date: 11/11/2022

Pot Size: $90,500 USDC

Total HM: 52

Participants: 92

Period: 7 days

Judge: LSDan

Total Solo HM: 20

Id: 182

League: ETH

Stakehouse Protocol

Findings Distribution

Researcher Performance

Rank: 56/92

Findings: 1

Award: $66.44

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: ladboy233

Also found by: 0xdeadbeef0x, SaeedAlipoor01988, bin2chen, immeas, minhtrng

Labels

bug
2 (Med Risk)
satisfactory
sponsor confirmed
duplicate-132

Awards

66.4388 USDC - $66.44

External Links

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/ETHPoolLPFactory.sol#L105

Vulnerability details

Impact

there is a limit for the Maximum amount that can be staked per validator in WEI. in the rotateLPTokens function when we move user deposited amount from one LP token to another LP token, we need to check maxStakingAmountPerValidator for a new LP token. otherwise, the deposit amount for the new LP token will be more than the specified value. total supply after minting the LP token must not exceed the maximum staking amount per validator

Proof of Concept

total supply after minting the LP token must not exceed the maximum staking amount per validator. https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/ETHPoolLPFactory.sol#L122

Tools Used

we can transfer only the allowed amount to a new LP token.

#0 - c4-judge

2022-11-20T22:04:01Z

dmvt marked the issue as primary issue

#1 - c4-sponsor

2022-11-28T17:48:55Z

vince0656 marked the issue as sponsor confirmed

#2 - c4-judge

2022-11-30T13:31:26Z

dmvt marked the issue as satisfactory

#3 - C4-Staff

2022-12-21T05:49:13Z

JeeberC4 marked the issue as duplicate of #132

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter