MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

tokens cannot be withdrawn from private pools

fondevs

Summary

tokens staked in private pools are locked and cannot be withdrawn

Vulnerability Details

private pools are managed by the owner by calling the manageUsersInPrivatePool function which then calls the function _withdraw depending on the amount difference, however the function _withdraw(address user_, uint256 poolId_, uint256 amount_, uint256 currentPoolRate_) only transferes tokens to the user if the pool is public

if (pool.isPublic) {
totalDepositedInPublicPools -= amount_;
​
IERC20(depositToken).safeTransfer(user_, amount_);
}

this means that tokens staked in private pools are locked and cannot be withdrawn

Impact

the impact of this finding is that tokens staked in private pools are locked and cannot be withdrawn

Tools Used

manual audit

Recommendations

change the lines

if (pool.isPublic) {
totalDepositedInPublicPools -= amount_;
​
IERC20(depositToken).safeTransfer(user_, amount_);
}

to

if (pool.isPublic) {
totalDepositedInPublicPools -= amount_;
}
IERC20(depositToken).safeTransfer(user_, amount_);
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.