vlad - Owner can't remove stakers which doesn't withdraw funds

[sherlock-admin2]

vlad

Medium

Owner can't remove stakers which doesn't withdraw funds

Summary

• https://github.com/sherlock-audit/2024-08-morphl2/blob/main/morph/contracts/contracts/l1/staking/L1Staking.sol#L181

If the staker decide not to withdraw funds, but became unavailable (key lose for example), then the staker will continue to hold the limited staker place. If many stakers became unavailable during the protocol time all 255 slots may be occupied by dead stakers and so rollup will stop working.

Root Cause

There are at most 255 stakers, if any stop withdrawing funds it is no longer possible to replace staker with another one.

Internal pre-conditions

Staker is not withdrawing funds.

External pre-conditions

No response

Attack Path

No response

Impact

• Protocol insolvency in case stakers are not available.
• Stakers can stop processing network to to stop the protocol and blackmail users with a lot of funds in the protocol.

PoC

No response

Mitigation

• Remove check for withdrawAmount on staker removal.