stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Users Lose the Boosted Rewards When they try to Withdraw the Tokens From the Protocol After the Lock Duration is Over.

mikebello

Summary

Users Lose the Boost Rewards if they ask for an Unlock Even When They have completed the Lock Duration time.

Vulnerability Details

In the Stake Link protocol, any user can stake SDL and other allowed tokens to earn rewards, all users who stake in the protocol have the ability to earn boosted rewards by locking their stake for a certain amount of time, if the user decides to lock their stake to earn boosted rewards, they have to wait the lock duration time to claim their stake plus the boosted rewards earn during that time, this is the way it should work but the process has a problem that cause any user that lock their stake to lose their boosted rewards.

Let's see the process and the problem in the next scenario:

1.- A user stakes tokens in the protocol and locks their tokens for 1 year.

2.- After the deposit and lock of the stake the user starts to earn boosted rewards and in a year He will double their tokens, because the boosted rewards allow you to double your tokens if you lock them for a year.

3.- After the year passed the user can withdraw his tokens, to withdraw their stake the user has first to ask for an Unlock of their tokens by calling the function initiateUnlock, and when the expiry time for unlocking the tokens (half of the lock duration) the user can then call the withdraw function and He should get back their tokens and the boosted rewards earned, but this is not the case, because the initiateUnlock function set the boosted amount to 0 and subtract the boosted amount from the EffectiveBalances

function initiateUnlock(uint256 _lockId) external onlyLockOwner(_lockId, msg.sender) updateRewards(msg.sender) {
***
uint64 expiry = uint64(block.timestamp) + halfDuration;
locks[_lockId].expiry = expiry;
​
uint256 boostAmount = locks[_lockId].boostAmount;
locks[_lockId].boostAmount = 0;
effectiveBalances[msg.sender] -= boostAmount;
totalEffectiveBalance -= boostAmount;
***
}

4.- When the expiry time ends and the user calls the withdraw function, just the amount staked is sent to the user, and the locks mapping is deleted from the system.

function withdraw(uint256 _lockId, uint256 _amount)
external
onlyLockOwner(_lockId, msg.sender)
updateRewards(msg.sender)
{
***
uint256 baseAmount = locks[_lockId].amount;
if (_amount > baseAmount) revert InsufficientBalance();
​
if (_amount == baseAmount) {
delete locks[_lockId];
delete lockOwners[_lockId];
// balance de locks creados por el usuario, puede crear muchos locks con diferentes amounts
balances[msg.sender] -= 1;
if (tokenApprovals[_lockId] != address(0)) delete tokenApprovals[_lockId];
emit Transfer(msg.sender, address(0), _lockId);
} else {
locks[_lockId].amount = baseAmount - _amount;
}
​
effectiveBalances[msg.sender] -= _amount;
totalEffectiveBalance -= _amount;
​
sdlToken.safeTransfer(msg.sender, _amount);
}

This causes the user to lose the boosted rewards.

To validate this behavior I created the next Test in the test/core/sdlPool/sdl-pool-primary.test.ts.

This test show that any user lose the Boosted rewards when they ask for an unlock of their stake after the lock duration time is over.

it.only('Users Lose the Boost Rewards if they ask for an Unlock Even When They have completed the Lock Duration time', async () => {
let stake = toEther(100)
// User Locks 100 ETH for 1 year to earn rewards.
await sdlToken.transferAndCall(
sdlPool.address,
stake,
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 365 * DAY])
)
// Second user deposits 150 ETH
await sdlToken
.connect(signers[1])
.transferAndCall(
sdlPool.address,
toEther(150),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 365 * DAY])
)
​
// Now more than 1 year has passed and the user tries to withdraw his tokens to get his tokens and the Boosted Rewards.
await time.increase(370 * DAY)
​
// Total Effective user's Balance after the Lock Duration Time ended: Staked amount + Boosted Rewards.
// This should be the amount the user has to be able to withdraw. should be doubled
let effectiveFinalBalance = await sdlPool.effectiveBalanceOf(accounts[0])
​
// The Effective user's Balance after a year has to be 200 => 100 staked + 100 boosted rewards.
assert.equal(fromEther(effectiveFinalBalance), 200)
// The total stake after a year has to be 500 => 200 user 0 + 300 user 1.
assert.equal(fromEther(await sdlPool.totalStaked()), 500)
​
// The user initiates an unlock request.
await sdlPool.initiateUnlock(1)
​
// The user has to wait Half of the Lock Duration Time to withdraw.
await time.increase(185 * DAY) // little more than a half year.
​
// Now the User tries to withdraw the amount staked + Boosted Rewards.
let finalAmount = stake + effectiveFinalBalance
// The Withdraw reverts cause the user loss the boosted rewards when they ask for Unlock.
await expect(sdlPool.withdraw(1, finalAmount)).to.be.revertedWith('InsufficientBalance()')
​
// User0 effective balance after asking for an unlock, it's 100 cause the user loses the boosted amount when they ask for the unlock, even when the lock duration has finished.
let effectiveBalanceAfterInitiateUnlock = await sdlPool.effectiveBalanceOf(accounts[0])
// Validating the Effective Final user's balance is equal to 100 instead of 200.
assert.equal(fromEther(effectiveBalanceAfterInitiateUnlock), 100)
})

Impact

High: The User loses all the Boosted Rewards even when they stake for the whole lock duration time.

Tools Used

Manual Code Review & Hardhat Tests.

Recommendations

The initiateUnlock function should check if the lock duration time of the user has ended or not, if the lock time has finished the boosted rewards should not be cleared and should be sum to the staked amount so the user can claim this boosted amount when He withdraws their stake, and if lock time hasn't ended then the function can work as it works now.

Updates

Lead Judging Commences

0kage Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.