setValidatorAddress allows exceeding the validator and delegator staking caps by 27 times
Summary
By design. validators are not allowed to stake more than validatorMaxStake. However, setValidatorAddress allows them to bypass that, as it does not check if the new validator address will have more CQT than validatorMaxStake (which can happen due to their previous stake as a delegator).
Vulnerability Detail
Imagine AliceTheValidator wants to stake 5x validatorMaxStake (or any amount exceeding validatorMaxStake) as a validator, and/or she wants to attract more delegated CQT than validatorMaxStake * maxCapMultiplier. Doing it via stake directly will result in "Validator max stake exceeded" error (as it should), so she needs a workaround.
So she stakes 5x validatorMaxStake as a delegator from another address (alice2), and then from alice1 calls setValidatorAddress(newAddress = alice2) . Now, alice2 is staking 6x validatorMaxStake as a validator. Moreover, her delegator staking limit is also increased by the same multiplier.
aslanbek
medium
setValidatorAddress allows exceeding the validator and delegator staking caps by 27 times
Summary
By design. validators are not allowed to stake more than
validatorMaxStake
. However,setValidatorAddress
allows them to bypass that, as it does not check if the new validator address will have more CQT thanvalidatorMaxStake
(which can happen due to their previous stake as a delegator).Vulnerability Detail
Imagine AliceTheValidator wants to stake 5x
validatorMaxStake
(or any amount exceedingvalidatorMaxStake
) as a validator, and/or she wants to attract more delegated CQT thanvalidatorMaxStake * maxCapMultiplier
. Doing it viastake
directly will result in "Validator max stake exceeded" error (as it should), so she needs a workaround.So she
stakes
5xvalidatorMaxStake
as a delegator from another address (alice2
), and then fromalice1
callssetValidatorAddress(newAddress = alice2)
. Now,alice2
is staking 6xvalidatorMaxStake
as a validator. Moreover, her delegator staking limit is also increased by the same multiplier.Foundry PoC
Impact
Validator and delegator staking caps exceed the intended values by up to
maxCapMultiplier
times (27x at launch).Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L696-L697
Tool used
Manual Review
Recommendation
Duplicate of #66