MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

outdated data in manageUsersInPrivatePool

zach030

Summary

In manageUsersInPrivatePool function, it handles batches of operations based on stale currentPoolRate_ data, which is erroneously not updated within the operational loop.

Vulnerability Details

The manageUsersInPrivatePool function is designed to process multiple user operations in a batch.

It uses the currentPoolRate_ variable to calculate the amount(line 131)

However, the vulnerability lies in the fact that currentPoolRate_ is determined before the execution of the batch processing loop and is not updated after each user's operation. (line 140,142)

Since each operation can potentially alter the currentPoolRate_, subsequent operations within the same batch are incorrectly calculated using outdated rate information.

function manageUsersInPrivatePool(
uint256 poolId_,
address[] calldata users_,
uint256[] calldata amounts_
) external onlyOwner poolExists(poolId_) {
require(!pools[poolId_].isPublic, "DS: pool is public");
require(users_.length == amounts_.length, "DS: invalid length");
​
-->131 uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
for (uint256 i; i < users_.length; ++i) {
address user_ = users_[i];
uint256 amount_ = amounts_[i];
​
uint256 deposited_ = usersData[user_][poolId_].deposited;
​
if (deposited_ < amount_) {
-->140 _stake(user_, poolId_, amount_ - deposited_, currentPoolRate_);
} else if (deposited_ > amount_) {
-->142 _withdraw(user_, poolId_, deposited_ - amount_, currentPoolRate_);
}
}
}

Impact

It leads to incorrect calculation of user stakes and withdrawals, potentially causing financial discrepancies.

Tools Used

Manual Review

Recommendations

update the currentPoolRate_ variable within the loop after each user's stake or withdrawal operation is processed.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong state update in case of Distributor.sol::manageUsersInPrivatePool() due to caching the currentPoolRate outside the loop

0xaadhi Auditor
over 1 year ago
inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.