The getValidatorCompoundedStakingData does not check if the validatorId is < than validatorsN.
Vulnerability Detail
getValidatorCompoundedStakingData function in OperationalStaking.sol should check if the passed parameter (validatorId) is less than the validators Number ( validatorsN )
Impact
This may lead to an unexpected behaviour in the first line of the function - Validator storage v = _validators[validatorId];
Code Snippet
function getValidatorCompoundedStakingData(uint128 validatorId) external view returns (uint128 staked, uint128 delegated) {
Validator storage v = _validators[validatorId];
// this includes staked + compounded rewards
staked = _sharesToTokens(v.stakings[v._address].shares, v.exchangeRate);
// this includes delegated + compounded rewards
delegated = _sharesToTokens(v.totalShares, v.exchangeRate) - staked;
return (staked, delegated);
}
Tool used
Manual Review
Recommendation
Add a require statement on the first line of the function:
function getValidatorCompoundedStakingData(uint128 validatorId) external view returns (uint128 staked, uint128 delegated) {
+ require(validatorId < validatorsN, "Invalid validator");
Validator storage v = _validators[validatorId];
// this includes staked + compounded rewards
staked = _sharesToTokens(v.stakings[v._address].shares, v.exchangeRate);
// this includes delegated + compounded rewards
delegated = _sharesToTokens(v.totalShares, v.exchangeRate) - staked;
return (staked, delegated);
}
Dobry
medium
Missing check for
validatorId
med
Summary
The
getValidatorCompoundedStakingData
does not check if thevalidatorId
is<
thanvalidatorsN
.Vulnerability Detail
getValidatorCompoundedStakingData
function inOperationalStaking.sol
should check if the passed parameter (validatorId
) is less than the validators Number (validatorsN
)Impact
This may lead to an unexpected behaviour in the first line of the function -
Validator storage v = _validators[validatorId];
Code Snippet
Tool used
Manual Review
Recommendation
Add a require statement on the first line of the function: