Skip to content

Latest commit

 

History

History
47 lines (26 loc) · 1.65 KB

111.md

File metadata and controls

47 lines (26 loc) · 1.65 KB
Raw

Acrobatic Charcoal Turkey

Medium

Funds can become stuck in the contract due to a lack of validation on the maximum fixedSideCapacity value.

Summary

The README states the following:

Withdrawal is limited because there is a maximum stETH withdrawal amount of 1000 stETH. This means that if a withdrawal exceeds 1000 stETH, it is split into multiple withdrawal requests and placed in these arrays with undefined length. This happens in the function calculateWithdrawals. Given this situation, we have set the fixedSideCapacity to 100,000 ETH. This ensures that any transaction involving withdrawals from the Lido Liquid Staking protocol will be sufficiently sized to fit within a single Ethereum block.

However, there is no restriction within the code to validate that fixedSideCapacity <= 100,000 ETH.

In the worst-case scenario, this could lead to all the stETH in the contract becoming stuck and unclaimable.

Root Cause

Missing validation in the initialize() function:
https://github.com/sherlock-audit/2024-08-saffron-finance/blob/main/lido-fiv/contracts/LidoVault.sol#L276-L309

Internal pre-conditions

  • fixedSideCapacity is set to a value > 100,000 ETH.

External pre-conditions

  • The vault is started with more than 100,000 ETH.

Attack Path

  1. Users deposit more than 100,000 ETH to the Fixed side.
  2. The vault operates as expected until the end.
  3. After the end, when the withdraw() function is called, it reverts due to exceeding the block gas limit.

Impact

  • README requirement violation.
  • Loss of funds.

PoC

Not needed.

Mitigation

Add a max fixedSideCapacity value validation to the initialize() function.