Submission Details
Severity:
Some reward tokens may be left in the contract when we migrate the staking contract
Summary
When we want to migrate the staking contract, some reward tokens will be left in the previous staking contract.
Vulnerability Details
When the migrator migrate the staking contract, the migrator will move the staking tokens to the new staking contract and claim reward tokens to the stakers.
The vulnerability is that there is still some left reward tokens from the last distribution period. And these reward tokens will be stuck in the previous contract.l
function migrateWithdraw(address staker, uint256 index) external override onlyMigrator returns (uint256) {
if (staker == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
StakeInfo storage _stakeInfo = _stakeInfos[staker][index];
uint256 stakerBalance = _stakeInfo.amount;
_withdrawFor(_stakeInfo, staker, msg.sender, index, _stakeInfo.amount, true, staker);
return stakerBalance;
}
Impact
Some reward tokens are stuck in the previous staking contract.
Tools Used
Manual
Recommendations
Transfer the left reward tokens to the new staking contract.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.