Submission Details
Severity:
In `TempleGoldStaking.sol::constructor` there is no check if `stakingToken` == `rewardToken`.
Summary
In the constructor there is no check. to make sure that the rewardToken should be the same as the stakingToken since templegold is used to stake and to reward
Vulnerability Details
constructor(
address _rescuer,
address _executor,
address _stakingToken,
address _rewardToken
) TempleElevatedAccess(_rescuer, _executor) {
//@audit no check if rewardToken is same as stakingToken.
stakingToken = IERC20(_stakingToken);
rewardToken = IERC20(_rewardToken);
}
Impact
In an incident where the staking token used is not the Temple Gold token.. temple gold tokens may be claimed in the rewarding. or vice versa. which is a great problem
Tools Used
foundry
Recommendations
check if staking and reward token are the same and there not the zero address.
if (stakingToken == rewardToken && stakingToken != address(0){
stakingToken = IERC20(_stakingToken);
rewardToken = IERC20(_rewardToken);
}
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.