Stolen rewards in StakingFundsVault

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/StakingFundsVault.sol#L315
https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/StakingFundsVault.sol#L343
https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/SyndicateRewardsProcessor.sol#L67

Vulnerability details

Impact

All rewards can be stolen from StakingFundsVault.

Proof of Concept

https://gist.github.com/clems4ever/b7dd7a6155ac01a9b5e1d8504cd8b5b0

Run with forge test

Tools Used

Manual review and forge

Recommended Mitigation Steps

• Rework the interaction between accumulatedETHPerLPShare and claimed.
• Protect the receive function of StakingFundsVault
• Protect all inhereted but publicly available methods from LPToken.

[dmvt]

I've asked the warden (in Discord) to add a few more comments to the gist:

"I think this is valid a different from the others you reported, but I'm having a slightly hard time with the use of the mocked privileged user (manager) in the middle of the test. More color to help explain how the hack happens without access to this user is important for validity and risk rating.
Please only add comments, don't remove anything"

[c4-judge]

dmvt marked the issue as primary issue

[c4-judge]

dmvt marked the issue as duplicate of #59

[c4-judge]

dmvt marked the issue as satisfactory

[C4-Staff]

JeeberC4 marked the issue as duplicate of #147