LSD Network - Stakehouse contest - shark's results

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/main/contracts/liquid-staking/LiquidStakingManager.sol#L280

Vulnerability details

Impact

In LiquidStakingManager.sol at Line 280, the function updateNodeRunnerWhitelistStatus() will always revert no matter what. Because of this, the whitelist status will never be updated.

Proof of Concept

File: LiquidStakingManager.sol Line 280

        require(isNodeRunnerWhitelisted[_nodeRunner] != isNodeRunnerWhitelisted[_nodeRunner], "Unnecessary update to same status");

Because the condition above is comparing that itself is not equal itself, it will always be false.

Recommended Mitigation Steps

Consider replacing the affected line to:

        require(isNodeRunnerWhitelisted[_nodeRunner] != isWhitelisted, "Unnecessary update to same status");

Use immutable variable

State variables that have no setter functions and can only be assigned at the constructor can be declared immutable.

Here is an example:

File: OptionalHouseGatekeeper.sol Line 14-16

    constructor(address _manager) {
        liquidStakingManager = ILiquidStakingManager(_manager);
    }

The variable above could be changed to immutable like so:

    ILiquidStakingManager public immutable liquidStakingManager;

    constructor(address _manager) {
        liquidStakingManager = ILiquidStakingManager(_manager);
    }

Here are all the other instances of this issue:

File: SavETHVaultDeployer.sol Line 13-16 File: StakingFundsVaultDeployer.sol Line 13-16 File: LPTokenFactory.sol Line 15-22 File: LPTokenFactory.sol Line 15-22 File: SyndicateFactory.sol Line 13-18 File: LSDNFactory.sol Line 15-68 File: GiantLP.sol Line 11-27

Empty event

File: Syndicate.sol Line 39

The following event is not emitting anything. Consider either refactoring to be of use or removing it.

    event ContractDeployed();

Unspecific Pragma Version

e.g. pragma solidity ^0.8.13; is very unspecific.

Locking the pragma helps ensure that contracts don't get deployed with unintended versions, for example, the latest compiler which could have higher risks of undiscovered bugs.

Typo mistakes

File: ETHPoolLPFactory.sol Line 74, Line 118, Line 124, Line 150

/// @audit Instane
74:    /// @param _newLPToken Instane of the new LP token (to be minted)

// Replace "it's" to "its"
118:            // KNOT and it's LP token is already registered


///@audit depoister
124:            // mint LP tokens for the depoistor with 1:1 ratio of LP tokens and ETH supplied

///@audit depoister
150:            // mint LP tokens for the depoistor with 1:1 ratio of LP tokens and ETH supplied