Submission Details
Severity:
`L2ContractMigrationFacet` never sets the global silo variables
Summary
L2ContractMigrationFacet#setStalk never sets the global silo variables
Vulnerability Details
When users migrate via L2ContractMigrationFacet, they're calculated the necessary stalk and get it minted via setStalk.
function setStalk(address account, uint256 accountStalk, uint256 accountRoots) internal {
s.accts[account].stalk += accountStalk;
s.accts[account].roots += accountRoots;
// emit event.
emit StalkBalanceChanged(account, int256(accountStalk), int256(accountRoots));
}
However, the global silo variables s.sys.silo.stalk and s.sys.silo.roots are never increased
Impact
Incorrect global state variables. Multiple critical functions which depend on it (plant, withdrawDeposit, minting/ burning stalk, etc) will fail/ lead to unexpected results
Tools Used
Manual review
Recommendations
Increase the global state variables
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
L2ContractMigrationFacet doesn't increase total Stalk and Roots
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.