The Standard

Summary

LiquidationPool.consolidatePendingStakes removes last staker, because of error inside deletePendingStake function.

Vulnerability Details

LiquidationPool.consolidatePendingStakes function loops through all pendingStakes and in case if it was created more than 1 day ago, then it removes that pending stake and increases user's position.

The problem lies in the deletePendingStake function, which copies next stake into current position and then pops last element. As result, next element is doubled and last element is lost.

Such behaviour creates different attack vectors that can increase user's stake or remove victim's pending stake. In all case this will cause wrong accounting.

Impact

deletePendingStake function removes last element without copying.

Tools Used

VsCode

Recommendations

You need to copy last element into current position and then you can remove it.