Submission Details
Severity:
LiquidationPool::consolidatePendingStakes () hardcoded value for pending stake limit
Summary and Vulnerability Details
The pending stake limit is hardcoded in the consolidatePendingStakes() function to the value of 1 day. This value should be configurable by the protocol owner.
Impact
There is no way to modify the time limit for pending stakes.
Tools Used
Manual Review
Recommendations
Add a state variable and a setter function for the pending staking limit to the LiquidationPool contract:
uint256 private pendingStakingDuration = 1 days;
...
function setPendingStakingDuration(uint256 _pendingStakingDuration) external onlyOwner {
pendingStakingDuration = _pendingStakingDuration;
}
...
function consolidatePendingStakes() private {
uint256 deadline = block.timestamp - pendingStakingDuration;
// rest of the code
}
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.