Submitted by oakcobalt
Code reference: YieldEthStakingLido.sol#L85
In Lidos WithdrawRequest(WithdrawalQueue.sol) implementation, only a withdraw request with stETH amount within MIN_STETH_WITHDRAWAL_AMOUNT, MAX_STETH_WITHDRAWAL_AMOUNT ( [100, 1000ether]) can be processed.
If the yieldAmount exceeds 1000ether, the withdrawal request has to be split into several requests.
The problem is YiedEthstaingLido::protocolDeposit has a vulnerable check on MAX_STETH_WITHDRAWAL_AMOUNT, and will still allow a position to stake more than MAX_STETH_WITHDRAWAL_AMOUNT overtime.
Since YieldEthStakingLido.sol doesnt allow splitting withdrawal of a staking position(yieldStakeData), any staking position exceeding MAX_STETH_WITHDRAWAL_AMOUNT cannot be unstaked. Funds will be locked in Lido.
Vulnerability: protocolDeposit can be called multiple times through stake(), allowing a user to incrementally stake more asset associated the same staked NFT. The check on the max cap through protocolDeposit is invalid because it only check any single stake amount is below the max cap. Multiple stakes can still exceed the max cap.
YieldEthStakingLido.sol#L85
YieldStakingBase.sol#L276
Unable to unstake, NFT locked and ETH locked in Lido.
Consider moving the max cap check (total yield amount + borrow) into YieldStakingBase::_stake. The actual check parameter can be pulled from YieldEthStakingLido.sol.
For example,
thorseldon (BendDAO) acknowledged and commented:
