Submission Details
Severity:
User's stalk is overwritten instead of increased within `ReseedSilo`
Summary
User's stalk is overwritten instead of increased within ReseedSilo
Vulnerability Details
Most user deposits will be migrated via ReseedSilo. Currently, it calculates user's stalk and sets the account's value to it
// increment stalkForAccount by the stalk issued per BDV.
// placed outside of loop for gas effiency.
accountStalk += stalkIssuedPerBdv * totalBdvForAccount;
// set stalk for account.
s.accts[deposits.accounts].stalk = accountStalk;
}
Although the function will be called only once upon deployment (with the deployment script), it is called for 6 different tokens
function init(
SiloDeposits calldata beanDeposits,
SiloDeposits calldata beanEthDeposits,
SiloDeposits calldata beanWstEthDeposits,
SiloDeposits calldata bean3CrvDeposits,
SiloDeposits calldata urBeanDeposits,
SiloDeposits calldata urBeanLpDeposits
) external {
// initialize beanDeposits.
reseedSiloDeposit(beanDeposits);
// initialize beanEthDeposits.
reseedSiloDeposit(beanEthDeposits);
// initialize beanWstEthDeposits.
reseedSiloDeposit(beanWstEthDeposits);
// initialize beanStableDeposits.
reseedSiloDeposit(bean3CrvDeposits);
// initialize urBeanDeposits.
reseedSiloDeposit(urBeanDeposits);
// initialize urBeanLpDeposits.
reseedSiloDeposit(urBeanLpDeposits);
}
Meaning that if any user has deposits in more than one of them, their stalk will get overwritten with the one of their latest migrated deposit.
Impact
Loss of stalk
Tools Used
Manual review
Recommendations
Increase instead of overwrite
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
User's stalk is overwritten instead of increased within `ReseedSilo`
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.