Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: gas

`withdraw()` should be protected against unnecessary underflows

bauchibred

Summary

No protections against underflows while executing withdraw()

Vulnerability Details

In the withdraw function of the Staking.sol contract, the amount _amount is deducted from the staker's balance without any preliminary checks on whether the staker's balance is sufficient for the deduction. The omission of this check can lead to potential underflows, especially in the scenario where _amount surpasses balances[msg.sender].

Code Snippet:

function withdraw(uint _amount) external {
updateFor(msg.sender);
balances[msg.sender] -= _amount;
TKN.transfer(msg.sender, _amount);
}

Impact

While Solidity version 0.8.x does automatically revert transactions in the event of an underflow, the absence of an explicit check may lead to confusion for users. Additionally, unnecessary gas could be expended due to the revert, increasing transaction costs for end-users.

Tools Used

Manual Audit

Recommend Mitigation

Add a requirement to ensure the staker's balance (balances[msg.sender]) is greater than or equal to _amount prior to any deductions.

Idea for adjusted code:

function withdraw(uint _amount) external {
require(balances[msg.sender] >= _amount, "Insufficient balance");
updateFor(msg.sender);
balances[msg.sender] -= _amount;
TKN.transfer(msg.sender, _amount);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.