Deposits can be maliciously bumped when oracle becomes stale/paused

[jokrsec]

Summary

When the score oracle in BinaryEligibilityOracleEarningPowerCalculator.sol becomes stale or paused, _amountStaked is returned as the earning power instead of the old earning power. As a result, a keeper can bump all ineligible deposits to eligible deposits when the oracle becomes stale/paused and bump them back to ineligible once the oracle becomes fresh/unpaused.

Vulnerability Detail

1. Let’s say there are 1,000 deposits delegated to ineligible delegatees, so their earning powers are currently zero.
2. Due to some reason, the oracle becomes stale or paused.
3. In this situation, the getNewEarningPower function of the binary eligibility calculator returns _amountStaked as the earning power instead of zero because of the following line:

   if (_isOracleStale() || isOraclePaused) return (_amountStaked, true);

4. As a result, keepers can bump all these ineligible deposits, as their earning powers change from zero to non-zero, and collect bump tips.
5. Once the oracle becomes normal again, those deposits can be bumped back, changing their earning powers from non-zero to zero, allowing keepers to extract bump tips again.

Impact

Deposits lose their rewards unfairly.

Code Snippet

function getNewEarningPower(
    uint256 _amountStaked,
    address, /* _staker */
    address _delegatee,
    uint256 /* _oldEarningPower */
  ) external view returns (uint256, bool) {
    // @audit-issue 
    if (_isOracleStale() || isOraclePaused) return (_amountStaked, true);

    if (!_isDelegateeEligible(_delegatee)) {
      bool _isUpdateDelayElapsed = (timeOfIneligibility[_delegatee] + updateEligibilityDelay) <= block.timestamp;
      return (0, _isUpdateDelayElapsed);
    }

    return (_amountStaked, true);
  }

Tool used

Manual Review

Recommendation

Return _oldEarningPower when oracle becomes stale or paused.

[alexkeating]

We believe the severity should be lowered to low/info. In this scenario depositors that want to avoid the extra bump fee will have the updateEligibilityDelay to switch their delegatee before being bumped down again. As mentioned if the oracle becomes malicious oldEarningPower could be destructive to the system. For example, if the oracle gives earning power to a set of malicious delegates than depositors would be incentivized to delegate to those malicious delegates.

[alexkeating]

Wont fix