LSD Network - Stakehouse contest - corerouter's results

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/SyndicateRewardsProcessor.sol#L51-L73 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/GiantMevAndFeesPool.sol#L73 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/GiantMevAndFeesPool.sol#L152 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/GiantMevAndFeesPool.sol#L161 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/GiantMevAndFeesPool.sol#L187 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/StakingFundsVault.sol#L88 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/StakingFundsVault.sol#L128 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/StakingFundsVault.sol#L333 https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/StakingFundsVault.sol#L337

Vulnerability details

Impact

In _distributeETHRewardsToUserForToken() function, as there is _recipient.call() function, which may enable a malicious _recipient involved to call _distributeETHRewardsToUserForToken() function repeatedly, before the first invocation of the function was finished. Meanwhile, the _distributeETHRewardsToUserForToken() itself and most of the function's caller have no Reentrance attack resistance mechanism in place. As a result, this may cause the different invocations of the function to interact in destructive ways and a malicious user may drain out more ETH he deserves.

Proof of Concept

https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/SyndicateRewardsProcessor.sol#L51-L73

Tools Used

Recommended Mitigation Steps

1. Add nonReentrant modifier to _distributeETHRewardsToUserForToken() function's signature. As a result, _distributeETHRewardsToUserForToken() function's signature changes to as follows:

function _distributeETHRewardsToUserForToken( address _user, address _token, uint256 _balance, address _recipient ) internal nonReentrant

2. claimed[_user][_token] reflects cumulative claimed value. As a result, https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/SyndicateRewardsProcessor.sol#L63

changes from:

claimed[_user][_token] = due;

to:

claimed[_user][_token] += due;