Submission Details
Severity:
Arithmetic underflow error
Summary
The "withdraw()" function can lead to an arithmetic underflow error when used before any deposits.
Vulnerability Details
The "withdraw()" function is utilized to withdraw deposited tokens from the staking contract. However, it can potentially cause an arithmetic underflow error if called before depositing any amount or when there are no tokens available for withdrawal.
function withdraw(uint _amount) external {
updateFor(msg.sender);
balances[msg.sender] -= _amount;
TKN.transfer(msg.sender, _amount);
}
Impact
When the function "withdraw()" is invoked without any prior deposits, may result in an arithmetic underflow error.
Tools Used
Manual Review
Recommendations
Use unchecked
unchecked {balances[msg.sender] -= _amount;}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.