Closed code423n4 closed 1 year ago
0xSorryNotSorry marked the issue as duplicate of #210
GalloDaSballo marked the issue as duplicate of #210
GalloDaSballo marked the issue as not a duplicate
GalloDaSballo marked the issue as duplicate of #408
GalloDaSballo marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L195-L198 https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L699-L705 https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L807-L814
Vulnerability details
Impact
The modifier
onlyNotFrozen()
is intuitive such that the staker will be frozen when the delegated operator is frozen. However, not utilizing it inrecordOvercommittedBeaconChainETH()
andundelegate()
could allow the Beacon Chain validator to undelegate from the frozen operator and escape the slash.Proof of Concept
Let's assume the validator has only
beaconChainETHStrategy
in his/herstakerStrategy
. It happens that the operator delegated is doing something not right and now frozen. The validator, after realizing this, purposely makes himself/herself over committed resulting in all shares removed from the enshrined beacon chain ETH strategy:https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L195-L198
Since
amount
isREQUIRED_BALANCE_WEI
, the same amount virtually deposited for new ETH validator, assuming that no rewards have been given, no existing shares is left and hence the strategy is removed from the depositor's dynamic array of strategies.https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L699-L705
The validator can now undelegate from the operator:
https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/core/StrategyManager.sol#L807-L814
The validator is now unfrozen and will escape the slash. On top of that, he/she is free to make a full withdrawal undeterred.
Recommended Mitigation Steps
It is recommended imposing
onlyNotFrozen
onrecordOvercommittedBeaconChainETH()
andundelegate()
to circumvent the leaked path.Assessed type
Timing