Submission Details
Severity:
Staking contracts should be assert TKN != WETH
Summary
The staking contract is incompatible with the same address of TKN and WETH. So you should force them to be different address in the constructor, otherwise it will mess up the internal accounting system.
Vulnerability Details
function claim() external {
updateFor(msg.sender);
WETH.transfer(msg.sender, claimable[msg.sender]);
claimable[msg.sender] = 0;
balance = WETH.balanceOf(address(this));
}
function update() public {
uint256 totalSupply = TKN.balanceOf(address(this));
if (totalSupply > 0) {
uint256 _balance = WETH.balanceOf(address(this));
if (_balance > balance) {
uint256 _diff = _balance - balance;
if (_diff > 0) {
uint256 _ratio = _diff * 1e18 / totalSupply;
if (_ratio > 0) {
index = index + _ratio;
balance = _balance;
}
}
}
}
}
The contract is not compatible with this situation such as the balance update in the claim function, totalSupply confuses the collateral and reward, which will disrupte internal accounting.
Impact
Staking contracts is not compatible with the same TKN and WETH, which will disrupte internal accounting.
Tools Used
Manual review
Recommendations
Assert TKN != WETH
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.