The onlyNativeEthRestakeAdmin may never receive gas refunds from OperatorDelegator as anyone may forward the rewards to receive()

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Delegation/OperatorDelegator.sol#L509-L516
https://github.com/Layr-Labs/eigenlayer-contracts/blob/dev/src/contracts/pods/DelayedWithdrawalRouter.sol#L100-L105

Vulnerability details

Impact

Admin never receives gas refunds as users abuse the fact that they may call DelayedWithdrawalRouter::claimDelayedWithdrawals(), not refunding the admin

Proof of Concept

Withdrawals are created in EigenPod::verifyAndProcessWithdrawals(). After the time delay, they may be claimed in the router via DelayedWithdrawalRouter::claimDelayedWithdrawals(), as it is not permissioned. OperatorDelegator::receive() claims the gas refund to the admin whenever it matches the tx.origin. However, if the tx is initiated by another user, no gas will be found in the mapping and the admin will not receive any refund.

Users are incentivized to do this because the gas refund discounts their tvl.

Tools Used

Vscode

Recommended Mitigation Steps

The gas refund should just go to the trusted admin instead of tx.origin.

Assessed type

Other

[c4-judge]

alcueca marked the issue as satisfactory

[c4-judge]

alcueca marked the issue as selected for report

[alcueca]

I like it when findings are clear and to the point.

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as not selected for report

[c4-judge]

alcueca marked the issue as grade-b

[alcueca]

The effect of gas refunds in the TVL is dust, therefore this is QA