The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Users That has Pending Euro Stakes Will not Receive distributed fees

inzinko

Summary

Users that want to increase their value of Euros staked, will not get distributed fees even though they have TST already staked. This is due to a vulnerability that prevents users that have pending stakes in Euros alone even though they have TST already staked, which the protocol states is the requirement to get distributed the fees

Vulnerability Details

When distributeFees function is called in the liquidation pool, the manager transfers the required amount to the contract and it then distributes those fees to every positions for every holder, It then adds those fees to every euro position based on their position of the TST staked as shown below

function distributeFees(uint256 _amount) external onlyManager {
uint256 tstTotal = getTstTotal();
if (tstTotal > 0) {
IERC20(EUROs).safeTransferFrom(msg.sender, address(this), _amount);
for (uint256 i = 0; i < holders.length; i++) {
address _holder = holders[i];
positions[_holder].EUROs += _amount * positions[_holder].TST / tstTotal;
}
for (uint256 i = 0; i < pendingStakes.length; i++) {
pendingStakes[i].EUROs += _amount * pendingStakes[i].TST / tstTotal;
​
//@audit Becuase Pending stakes for the TST is zero the amount of fees that will be added to the EUROS pending stakes will be zero, which means users that do not stake TST at the same time they Stake EUROS will not receive Fees, even though they have a TST position
}
}
}

As you can see above, after doing and sharing the fees for the positions, it goes to the pending stakes, but in the pending stakes, stakes that do not have TST staked, will not get fees distributed to it, and will receive zero euro added to it, even though the Protocol States that every holder will receive these fees as long they have TST staked. This Line of code assumes that

  • Every user will stake TST and EURO every time they want to increase their positions, which is not the case, as some holders may try to increase their Euro position, because of the euro cost of the upcoming liquidation

Impact

No Fees are Distributed To Users who Just Want to increase their EUROs position even though they have a Valid TST position

Tools Used

Manual Review

Recommendations

This Block of code Should Be Removed

for (uint256 i = 0; i < pendingStakes.length; i++) {
pendingStakes[i].EUROs += _amount * pendingStakes[i].TST / tstTotal;

This Should Be done So That Some users do not miss out on fees, which means that rewards are shared only to valid positions and not stakes that have not being consolidated, and everyone should receive those fees, as described by the protocol rules

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

no-fee-euro

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.