MorpheusAI

Summary

In Distribution.sol the function manageUsersInPrivatePool() does not account for all amounts, which could lead to locked funds.

Vulnerability Details

Suppose there is User A in a private pool.

User A is staked for by the protocol owner, the minimum staking amount.

Then the owner proceeds to try and withdraw the funds of User a by calling the manage users function.

However the line

} else if (deposited_ > amount_) {

requires that the amount to be withdrawn is strictly less than the amount deposited however this will revert as the withdraw function requires that a user has a minimum stake remaining in the protocol or all funds are withdrawn.

Impact

Locked funds.

Tools Used

Manual Review

Recommendations

I would recommend that the strictly less than be change to less than or equal to. Another approach would be to add another array to state whether the owner is staking or withdrawing, then for the logic to be changed accordingly.