LSD Network - Stakehouse contest - satoshipotato's results

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L29 https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L50 https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L55

Vulnerability details

Impact

Hacker may deploy a fake SavETHVault which siphons funds to his address on any deposit. Users deposits may be irretrievably lost.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. The function batchDepositETHForStaking is publicly callable with unchecked _savETHVaults addresses: https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L29

Hacker can deploy a copy of a SavETHVault which bypasses the check on line 50 in GiantSavETHVaultPool.sol by setting the liquidStakingManager variable in SavETHVault to a valid liquidStakingManager address: https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L50 and bait users to deposit in his SavETHVault using batchDepositETHForStaking. The malicious contract may directly transfer the ETH to the hacker's address on the savETHPool.batchDepositETHForStaking call on line 55: https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantSavETHVaultPool.sol#L55 and thus drain an innocent user's ETH.

Tools Used

Slither, Forge, VS Code Solidity Plugin

Recommended Mitigation Steps

Add a mapping (address => bool) isValidSavETHVault in SavETHVaultDeployer, which returns true for the SavETHVault addresses which have been deployed using SavETHVaultDeployer and a function isValidSavETHVault in LSDNFactory, which returns true if the SavETHVault has been deployed using SavETHVaultDeployer. Then, in GiantSavETHVaultPool.sol add a require:

require(
                liquidStakingDerivativeFactory.isValidSavETHVault(address(savETHPool)),
                "Invalid savETHPool"
            );