Submission Details
Severity:
Wrong amount of funds being distributed in `Credibility::mint()`
Summary
After the NFT are staked, the number of cred tokens that are distributed as rewards when unstaked is wrong as the decimals was not taken into consideration
Vulnerability Details
here is the snippet of the current code
function mint(address to, uint256 amount) public onlyStreetContract {
@> _mint(to, amount);
}
Impact
since the number of decimals was not taken into consideration, it would actually mint 1/10 ** 18 of the token
Tools Used
Manual Review
Recommendations
The recommended step to mitigate the issue is :
function mint(address to, uint256 amount) public onlyStreetContract {
- _mint(to, amount);
+ _mint(to, amount * 10 ** decimals());
}
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
`unstake` function mints incorrect amount of token
Rewards breakdown
nSLOC
201This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.