SavETHVault / StakingFundsVault: maxStakingAmountPerValidator may not be reachable

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/a0558ed7b12e1ace1fe5c07970c7fc07eb00eebd/contracts/liquid-staking/ETHPoolLPFactory.sol#L111
https://github.com/code-423n4/2022-11-stakehouse/blob/23c3cf65975cada7fd2255a141b359a6b31c2f9c/contracts/syndicate/Syndicate.sol#L215

Vulnerability details

Impact

In ETHPoolLPFactory._depositETHForStaking, a minimum deposit amount (set to 0.001 ether) is required:

require(_amount >= MIN_STAKING_AMOUNT, "Min amount not reached");

On the other hand, the maximum amount is also restricted such that maxStakingAmountPerValidator will not be exceeded:

require(lpToken.totalSupply() + _amount <= maxStakingAmountPerValidator, "Amount exceeds the staking limit for the validator");

This combination of checks can lead to situations where maxStakingAmountPerValidator is never reachable, namely when lpToken.totalSupply() > maxStakingAmountPerValidator - MIN_STAKING_AMOUNT. Every deposit that is larger than MIN_STAKING_AMOUNT will revert because it would exceed the maximum staking amount and every deposit that is smaller reverts because this is the enforced minimum.

Note that the same problem also can occur in Syndicate.stake where a minimum stake amount of 1 gwei is enforced, but the total staked amount cannot exceed 12 ether.

Proof Of Concept

Let's say that a StakingFundsVault for a given BLS public key has already 4 - 0.001 ether and 1 wei. When a user now wants to deposit < 0.001 ether, the call reverts because the minimum amount is not reached. For more than 0.001 ether, the call reverts because this would exceed the staking limit.

Recommended Mitigation Steps

Do not allow deposits that bring the total supply into the range [maxStakingAmountPerValidator - MIN_STAKING_AMOUNT, maxStakingAmountPerValidator - 1].

[c4-judge]

dmvt marked the issue as primary issue

[c4-judge]

dmvt changed the severity to G (Gas Optimization)

[dmvt]

Note, this should be medium, not Gas. Accidental button click on my end.

[Simon-Busch]

@dmvt Fixed and revert as per your request

[c4-sponsor]

vince0656 marked the issue as sponsor confirmed

[c4-judge]

dmvt marked the issue as satisfactory

[C4-Staff]

JeeberC4 marked the issue as duplicate of #422