Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

set `feePerSecond` too high allow owner to drain depositor funds

ElHaj

Summary

  • The owner can manipulate shares and execute a rug pull by setting feePerSecond excessively high.

Vulnerability Details

  • the owner have the ability to set the FeePerSecond which is uint256 to any . (it's not bounded), by calling the function updateFeePerSecond() the the owner can raise the fee too high which will mint LP the Treasury contract which also the owner have the ability to change it's address to any.

  • With the increased LP token supply, the value of users' shares is diluted, rendering them nearly worthless.

  • the owner then can withdraw this lps and rugpull the users.

Impact

  • users lose thier deposits .

Tools Used

  • manual review .

Recommendations

  • set a max and min fee that the owner can set perSecond.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Centralization Risk

Impact: High Likelihood: Low Centralization risk is regarded a known issue. This tag will include all submissions : - Admin setter functions without validations

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Centralization Risk

Impact: High Likelihood: Low Centralization risk is regarded a known issue. This tag will include all submissions : - Admin setter functions without validations

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.