Closed sherlock-admin2 closed 7 months ago
1 comment(s) were left on this issue during the judging contest.
takarez commented:
valid
Invalid, validators disabling themselves will only harm them given they will not be eligible for rewards anymore.
caventa
medium
Validator unstaking exploit extends delegator cooldown period
Summary
Validator could misuse unstaking process to delay or indefinitely delay delegators from unstake to receive their funds
Vulnerability Detail
See _unstake function
Steps for potential exploitation:
A validator begins with a stake slightly above the required minimum. The validator frequently unstakes small amounts, causing their total stake to fall below the minimum threshold. When the validator's stake drops below the minimum, the contract automatically disables them and records the current block number in v.disabledAtBlock. After each disabling, the validator sets up a new unstaking instance. The cooldown end for these instances is determined based on v.disabledAtBlock. Through repeated actions, the validator can consistently prolong the cooldown period.
Impact
The "rewardValidators" function rewards validators based on an amount, and this amount should have a correlation with the share. See the following partial code snippet from the rewardValidators function
If a validator can maintain their delegator stake for a longer period, they have the potential to receive more rewards because the total share (or "share" amount) will be larger.
Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L523-L533
Tool used
Manual Review
Recommendation
Modify the contract to prevent validators from influencing the timing of delegator unstaking and fund access.