Submission Details
Severity:
`L2ContractMigrationFacet` does not account for germinating stalk
Summary
L2ContractMigrationFacet does not account for germinating stalk
Vulnerability Details
L2ContractMigrationFacet#addMigratedDepositsToAccount calculates user stalk, but does not check if the stem is <= stemTip. This would allow for stalk which should not yet be germinated, be minted as such.
// increment stalkForAccount by the stalk issued per BDV.
// placed outside of loop for gas effiency.
accountStalk += stalkIssuedPerBdv * totalBdvForAccount;
Impact
Unfair minting of germinated stalk. Unfair gaining of voting power
Tools Used
Manual review
Recommendations
check if stalk is germinated and mint it accordingly.
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.