Attacker can DOS a new user in Native Restaking

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L184-L187 https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L218-L219

Vulnerability details

Impact

An attacker (any user) can 1 time DOS a new user when he is trying to add validators to his native node.

Proof of Concept

After a user creates a native node, and proceeds to call the validateWithdrawalCredentials() function, any user can frontrun this transaction and call the validateExpiredSnapshot() function. Since the lastSnapshotTimestamp = 0 for the user's nativenode, the following check in the validateExpiredSnapshot() function would pass: (https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L218-L219)

if (node.lastSnapshotTimestamp + Constants.SNAPSHOT_EXPIRY > block.timestamp) { revert SnapshotNotExpired(); }

This would set the node's currentSnapshotTimestamp as block.timestamp and would cause the validateWithdrawalCredentials() function to revert because of this check: (https://github.com/code-423n4/2024-07-karak/blob/f5e52fdcb4c20c4318d532a9f08f7876e9afb321/src/NativeVault.sol#L184-L187)

if ( beaconStateRootProof.timestamp < node.lastSnapshotTimestamp || beaconStateRootProof.timestamp < node.currentSnapshotTimestamp ) revert BeaconTimestampTooOld();

So an attacker can DOS the user the first time he is trying to add validators to his node.

Tools Used

Manual

Recommended Mitigation Steps

Add the following checks in the validateExpiredSnapshot() function at line 217: if (node.lastSnapshotTimestamp == 0) revert NewlyCreatedNode();

Assessed type

DoS

[c4-judge]

MiloTruck changed the severity to QA (Quality Assurance)

[c4-judge]

MiloTruck marked the issue as grade-b