Closed sherlock-admin2 closed 7 months ago
1 comment(s) were left on this issue during the judging contest.
takarez commented:
valid: duplicate of issue 088; although the recommendation here again does not take into account where the previous staked is going to; subtractting it means just lossing it; high(1)
zach223
high
When updating the validator address with the
setValidatorAddress
function, the delegated amount is not adjusted which may lead to the validator’s potential lossesSummary
In the
setValidatorAddress
function of theOperationalStaking
contract, the validator address self-updates the address information for the correspondingvalidatorId
and invalidates the old validator address. However, if the new validator address was previously delegated tokens to the correspondingvalidatorId
using thestake
function, the delegation amount should be subtracted from_validators[validatorId].delegated
after this address becomes the new validator address. Failure to do so may result in an excessive_validators[validatorId].delegated
number for the new validator address, causing potential losses.Vulnerability Detail
Considering the following scenario:
_validators[0]._address
, and Address B callsstake(0, delegationMaxCap)
.setValidatorAddress(0, Address B)
, making Address B the new_validators[0]._address
.unstake
function would trigger the constraintv.delegated <= newValidatorMaxCap
.Impact
An inflation of
_validators[validatorId].delegated
beyond the actual value can lead to the following two impacts:validatorId
is reduced due to the constraintv.delegated + amount <= delegationMaxCap
.Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L689-L711
Tool used
Manual Review
Recommendation
It is recommended to add the additional code below the
require(!v.frozen, "Validator is frozen”);
line in thesetValidatorAddres
s function:This line ensures that the
delegated
value is adjusted by subtracting the staked amount associated with the new address in thesetValidatorAddress
function.Duplicate of #66