stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

SDLPoolPrimary::User can lock minimum amount of SDL for maximum time and get boost for that.

0xAbinash

Summary

In SDLPoolPrimary.sol contract there is function to stake and lock SDL : onTokenTransfer(), it does not have minimum limit check for value to be staked & locked which allows malicious users to lock a very minimum amount of SDL [ just greater than 0 ] for maxLockingDuration and get boost for that over the period.

Vulnerability Details

In onTokenTransfer() there is no check for minimum allowance of SDL token. Here is the code:

function onTokenTransfer(
address _sender,
uint256 _value,
bytes calldata _calldata
) external override {
if (msg.sender != address(sdlToken) && !isTokenSupported(msg.sender)) revert UnauthorizedToken();
​
if (_value == 0) revert InvalidValue(); // See this line, even 0.001 SDL token is allowed
​
if (msg.sender == address(sdlToken)) {
(uint256 lockId, uint64 lockingDuration) = abi.decode(_calldata, (uint256, uint64));
if (lockId != 0) {
_storeUpdatedLock(_sender, lockId, _value, lockingDuration);
} else {
_storeNewLock(_sender, _value, lockingDuration);
}
} else {
distributeToken(msg.sender);
}
}

Now any user can lock very less token for maxLockingDuration and as boost is proportional to the length of locking period the user can get unnecessary benefit.

POC

Run this test:

it('can lock minimum amount', async () => {
//@audit
await expect(sdlToken.connect(signers[1]).transferAndCall(
sdlPool.address,
toEther(0.000001),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 4*365 * DAY])
)).not.to.be.reverted
})
assert.equal(fromEther(await sdlToken.balanceOf(sdlPool.address)), 0.000001)

Impact

Unnecessary boosts will to give to those bad users.

Tools Used

Manual analysis

Recommendations

Add minimum limit of token to be locked instead of checking for 0 value.

Updates

Lead Judging Commences

0kage Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.