Verifying the staking instance can be bypassed

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-05-olas/blob/3ce502ec8b475885b90668e617f3983cea3ae29f/registries/contracts/staking/StakingVerifier.sol#L206-L221

Vulnerability details

Impact

Detailed description of the impact of this finding.

Proof of Concept

Comment out the stakingToken function in MockStaking and add the following test to ServiceStakingFactory.js

Run with: npx hardhat test --grep "Test verification on no staking token function"

        it("Test verification on no staking token function", async function () {
            // Set the verifier
            await stakingFactory.changeVerifier(stakingVerifier.address);

            // Whitelist implementation
            await stakingVerifier.setImplementationsStatuses([staking.address], [true], true);

            initPayload = staking.interface.encodeFunctionData("initialize", [token.address]);
            
            await expect(
                stakingFactory.createStakingInstance(staking.address, initPayload)
            ).to.be.revertedWithCustomError(stakingFactory, "UnverifiedProxy");
        });

Tools Used

Manual Review, JS

Recommended Mitigation Steps

In StakingVerifier::vefiryInstance return false if the staticall fails

    function verifyInstance(address instance, address implementation) external view returns (bool) {
...
        bytes memory tokenData = abi.encodeCall(IStaking.stakingToken, ());
        (bool success, bytes memory returnData) = instance.staticcall(tokenData);

        // Check the returnData is the call was successful
        if (success) {
            // The returned size must be 32 to fit one address
            if (returnData.length == 32) {
                address token = abi.decode(returnData, (address));
                if (token != olas) {
                    return false;
                }
            } else {
                return false;
            }
+        } else {
+            return false;
+        }

        return true;
    }

Assessed type

Invalid Validation

[c4-bot-5]

Withdrawn by yotov721