TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Vesting Period

1337web3

Summary

A vulnerability was identified in the vesting rate calculation within the smart contract. If the vestingPeriod is modified, it can result in a vestingRate exceeding the maximum value of 1e18.

Vulnerability Details

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/TempleGoldStaking.sol#L484-L493

The issue arises when an administrator changes the vestingPeriod to a smaller value after stakes have been made. This can lead to an incorrect calculation of the vestingRate, allowing it to exceed 1e18.

Example Scenario:

  1. Initial conditions:

    • stakeTime = 300

    • vestingPeriod = 200

  2. Administrator changes the vestingPeriod to 50.

  3. The current timestamp is 401.

  4. The vestingRate calculation will be 2e18.

This calculation results in a vestingRate of 2e18, which is twice the intended maximum rate.

Impact

Allowing the vestingRate to exceed 1e18 can lead to incorrect vesting and potential financial discrepancies within the smart contract.

Tools Used

Manual Review

Recommendations

Implement a check in the _getVestingRate function to ensure the vestingRate does not exceed 1e18:

function _getVestingRate(StakeInfo memory _stakeInfo) internal view returns (uint256 vestingRate) {
if (_stakeInfo.stakeTime == 0) {
return 0;
}
if (block.timestamp > _stakeInfo.fullyVestedAt) {
vestingRate = 1e18;
} else {
vestingRate = (block.timestamp - _stakeInfo.stakeTime) * 1e18 / vestingPeriod;
+ if (vestingRate > 1e18) {
+ vestingRate = 1e18;
+ }
}
}

This ensures that the vestingRate is capped at 1e18, preventing the vulnerability from being exploited.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Changes to vesting period is not handled inside `_getVestingRate`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.