Kelp DAO | rsETH - passion's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTConfig.sol#L80-L89

Vulnerability details

Impact

In the LRTDepositPool contract, the LRTAdmin is allowed to call the addNodeDelegatorContractToQueue function to add a nodeDelegator to the queue, there is a missing validation to check if the nodeDelegator is already in the array this could lead to one nodeDelegator that gets added more than once since the protocol only allows for adding nodeDelegators and doesn't have any way to remove nodeDelegators.

This could be an issue for the protocol since it always needs to keep in mind that one or more nodeDelegators would have more than 1 element in the array.

Proof of Concept

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTConfig.sol#L80-L89

    function addNodeDelegatorContractToQueue(address[] calldata nodeDelegatorContracts) external onlyLRTAdmin {
        uint256 length = nodeDelegatorContracts.length;
        if (nodeDelegatorQueue.length + length > maxNodeDelegatorCount) {
            revert MaximumNodeDelegatorCountReached();
        }

        for (uint256 i; i < length;) {
            UtilLib.checkNonZeroAddress(nodeDelegatorContracts[i]); 
            nodeDelegatorQueue.push(nodeDelegatorContracts[i]);
            emit NodeDelegatorAddedinQueue(nodeDelegatorContracts[i]);
            unchecked {
                ++i;
            }
        }
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Consider using the same method as used with supported assets or add a function to remove from the NodeDelegatorQueue

        if (isNodeDelegatorQueue[nodeDelegatorContracts]) {
            revert alreadyInNodeDelegatorQueue();
        }
        isNodeDelegatorQueue[nodeDelegatorContracts] = true;
        nodeDelegatorQueue.push(nodeDelegatorContracts);

Assessed type

Invalid Validation