almurhasan - Calling function queueWithdrawalForUserSettlement will revert.

[sherlock-admin]

almurhasan

high

Calling function queueWithdrawalForUserSettlement will revert.

Summary

This function will revert due to a require statement in eigenlayer’s delegationmanager contract.the statement is withdrawer must be staker.but here withdrawer is not staker.

Vulnerability Detail

1. Let assume the function queueWithdrawalForUserSettlement is called by Coordinator contract for user settlement.
2. This function calls the _queueWithdrawal function i.e _queueWithdrawal(strategy, shares, address(withdrawalQueue()));
3. See the _queueWithdrawal function, here withdrawer is set to withdrawalQueue contract in QueuedWithdrawalParams.
4. Now the function _queueWithdrawal calls the delegationManager’s queueWithdrawals function.
5. See function queueWithdrawals(delegationManager contract),where a statement is require(queuedWithdrawalParams[i].withdrawer == msg.sender, "DelegationManager.queueWithdrawal: withdrawer must be staker");
   Here withdrawer must be msg.sender
6. In RioLRTOperatorDelegator contract ,queuedWithdrawalParams[i].withdrawer is set to withdrawalQueue contract but here msg.sender of the function queueWithdrawals(delegationManager contract) is RioLRTOperatorDelegator contract. This will cause a revert.

Impact

Usersettlement will fail.

Code Snippet

https://github.com/sherlock-audit/2024-02-rio-network-core-protocol/blob/main/rio-sherlock-audit/contracts/restaking/RioLRTOperatorDelegator.sol#L217

https://github.com/Layr-Labs/eigenlayer-contracts/blob/dev/src/contracts/core/DelegationManager.sol#L275

Tool used

Manual Review

Recommendation

Make sure withdrawer and msg.sender is same when calling the function queueWithdrawals(delegationManager contract)

[solimander]

Invalid - Though we will be updating to support this change, it was made after the audited code was frozen. The target version is https://github.com/Layr-Labs/eigenlayer-contracts/tree/v0.2.1-goerli-m2

[nevillehuang]

@solimander What was the exact time this change was introduced and do you have a link? I will have to consider only time after 20 February when the contest started.

[nevillehuang]

@solimander Could you point me to the right resource from the above comment?

[solimander]

@nevillehuang It was merged into the m2-mainnet branch in this PR: Layr-Labs/eigenlayer-contracts#409

Target tag was noted here: https://discord.com/channels/812037309376495636/1209514827442167839/1209965316323672084