Summary

Incomplete logic of deposited_ == amount_ in manageUsersInPrivatePool function might lead to inconsistencies or unintended behavior. And missing verification in _send and _withdraw in private pool could allow unauthorized stakes, withdrawals or manipulation of balances.

Vulnerability Details

While both the stake and withdraw function are restricted to only public pools by the modifier poolPublic, manageUsersInPrivatePool function need to handle _stake and _withdraw in private pool. The lack of checks and access controls specific to private pools could create vulnerabilities. Malicious actors might exploit these vulnerabilities to manipulate pool funds or gain unauthorized access. For example , the else block in the _withdraw function subtracts the withdrawal amount from the user's deposited balance (deposited_) without check like it does in public pool.

Moreover, the manageUsersInPrivatePool function only calls _stake or _withdraw when there's a difference between deposited_ and amount_. The code doesn't handle the scenario where deposited_ equals amount_, potentially leading to missed updates or unexpected actions.

Therefore, it is recommended to add a check to verify for both private and public pools before proceeding, and add an else block to address deposited_ == amount_ as shown below:

Distribution::poolPublic
Distribution::manageUsersInPrivatePool
Distribution::stake
Distribution::_stake
Distribution::withdraw
Distribution::_withdraw

Impact

Incomplete logic of deposited_ == amount_ in manageUsersInPrivatePool function might lead to inconsistencies or unintended behavior. And allowing stakes and withdrawals from non-public pools without restrictions can pose a security risk.

Tools Used

Manual Review

Recommendation

Therefore, it is recommended to add a check to verify for both private and public pools before proceeding, and add an else block to address deposited_ == amount_ as shown in Vulnerability Details.