20,000 USDC
View results
Submission Details
Severity: medium

Attacker can stop staking contract from paying rewards

Attacker can deposit and claim. Deposit will update the balance
and claim will decrease the contract's WETH balance.

With a large enough deposit an attacker can manipulate the balance
so this condition is always false

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol#L65

For subsequent deposits index won't be calculated which means delta will always be zero

https://github.com/Cyfrin/2023-07-beedle/blob/main/src/Staking.sol#L86

Mitigation steps:

Updating balance when claiming

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.