Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: gas
Valid

Inconsistent Token Balance Comparison

maroutis

Summary

In the staking contract, the update function seems to make calculations using two different token balances.

Vulnerability Detail

File: Staking.sol
update() public {
uint256 totalSupply = TKN.balanceOf(address(this));
if (totalSupply > 0) {
uint256 _balance = WETH.balanceOf(address(this));
if (_balance > balance) {
uint256 _diff = _balance - balance;

Comparing balances of tokens with varying decimals and oracle prices directly will not lead to a meaningful result. Instead of a direct balance comparison, relative valuations (in ETH, USD, etc.) should be used.

Impact

Users could be subjected to incorrect staking rates, resulting in potential monetary loss.

Tools Used

A thorough review of the code base was conducted to identify this issue.

Recommendation

Implement a conversion-based comparison for greater accuracy. Use a decentralized Oracle like Chainlink for conversions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.