The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

User not able to decreasePosition if she only choose to stake 1 type of token in the firstplace

thedoctor

Summary

Users will not be able to decreasePosition if they only invest 1 type of token, with a higher chance being TST since it accrues rewards. In this case, user have to deposit 1 sEURO and wait 1 day again, which in the crypto nature, lots of things can happen within 24 hour period. This means that if TST or sEURO token crashes, and the user is not able to withdraw, she will lose the value.

Vulnerability Details

Let say that Alice deposit 100 TST into the LiquidationPool, with 0 sEURO. After 1 day, she decreasePosition, which she cannot do so since she did not deposit sEURO tokens.

//LiquidationPool::increasePosition
require(_tstVal > 0 || _eurosVal > 0);
...
​
// LiquidationPool::decreasePosition
require(_tstVal <= positions[msg.sender].TST && _eurosVal <= positions[msg.sender].EUROs, "invalid-decr-amount");

Impact

User not able to decrease position and withdraw if only deposit with either TST or sEURO token.

Tools Used

Recommendations

Ensure that in the LiquidationPool::increasePosition and LiquidationPool::decreasePosition set amount to be equal and require both tokens to be deposited without allowing user to choose to deposit vary amount of each type of token.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

informational/invalid

thedoctor Submitter
almost 2 years ago
hrishibhat Lead Judge
over 1 year ago

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.