Summary:

The TempleGoldStaking contract has a high-critical vulnerability in the migrateWithdraw function. The function allows an attacker to withdraw funds and claim Rewards of other stakers by exploiting the fact that the msg.sender can be any address, including an attacker. This can occur even if the migrator address is correctly set because there is no check to ensure that only the rightful staker can withdraw their own funds.

• staker = address stakerA (also a migrator)

• attacker = address msg.sender (also a migrator)

Impact:

An attacker who is set as the migrator can call migrateWithdraw and withdraw funds and calim Rewards from any staker's account by passing the staker's address and the index of their stake.

Proof of Concept (explanation) :

• if attacker is migrator (msg.sender)

• attacker calls migrateWithdrawfunction by passing other staker addresses as parameters and index

• then call_withdraFor in the function

• attcker withdraw funds from other stakers account

• its also Claims the Rewards where Claim = true as boolean parameter in_withdrawForfunction

• because their no any checks like msg.sender==staker present in function

• hence it exploits it.

function from Contract:

Test Code

Tools Used:

Manual audit, Foundry

Recommendations:

Modify the migrateWithdraw function to ensure that only the rightful staker can withdraw their funds. Add a check to ensure that the msg.sender is the staker: