Risk of wasting ETH balance in DepositQueue
#505
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
grade-a
Q-30
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_37_group
AI based duplicate group recommendation
sufficient quality report
This report is of sufficient quality
Lines of code
https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L283-L289
Vulnerability details
Impact
The administrator has the ability to drain the ETH balance of the
DepositQueue
contract by calling certain functions with a high gas price. This can lead to:Proof of Concept
NATIVE_ETH_RESTAKE_ADMIN
, calls thestakeEthFromQueue
orstakeEthFromQueueMulti
functions, any consumed gas is refunded to themsg.sender
.https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L187-L206
https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L211-L250
DepositQueue
contract and is calculated based on(initialGas - gasleft()) * tx.gasprice
.https://github.com/code-423n4/2024-04-renzo/blob/main/contracts/Deposits/DepositQueue.sol#L283-L289
tx.gasprice
, it can lead to a substantial drain on the contract's balance. For example the transactionhttps://etherscan.io/tx/0xc5ae7b766c0186590d4baf648a17b1e59f96c01a540e3b5aee675e87a882555f
shows that calling the functionstakeEthFromQueueMulti
for two operator delegators consumes almost 286745 gas. If the admin sets the gas price in the transation to 1000 Gwei, almost 0.287 ETH will be wasted from the contract. The admin does not gain financially, but it can adversly impacts on the protocol.Tools Used
Recommended Mitigation Steps
Modify the
_refundGas
function to allocate only a small percentage of the contract's balance for gas refunds:Assessed type
Context
The text was updated successfully, but these errors were encountered: