TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`migrateWithdraw()` claims reward by default which should be optional

tripathi

Summary

DOCs says

Migration is built in, if there is an upgrade to staking contract. First, setMigrator() is called. Migrator is the next staking contract. Migrator calls migrateWithdraw() to withdraw and migrate staker's stake amount and optionally claim rewards. Rewards can be claimed after migration

https://github.com/TempleDAO/temple/blob/templegold/protocol/contracts/templegold/README.md#staking

However, in the implementation, claiming rewards during migration is not optional. The migration call always claims the rewards.

Vulnerability Details

function migrateWithdraw(address staker, uint256 index) external override onlyMigrator returns (uint256) {
if (staker == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
StakeInfo storage _stakeInfo = _stakeInfos[staker][index];
uint256 stakerBalance = _stakeInfo.amount;
_withdrawFor(_stakeInfo, staker, msg.sender, index, _stakeInfo.amount, true, staker);
//@audit-issue claimreward is hardcoded to true
return stakerBalance;
}

Throughout the codebase and documentation, claiming rewards is intended to be optional in the withdraw call. However, this implementation fails to make it optional.

Impact

During migration, the staker will always have to claim rewards in the same call, whereas it is meant to be optional.

Tools Used

Manual

Recommendations

function migrateWithdraw(address staker, uint256 index, bool claim) external override onlyMigrator returns (uint256) {
if (staker == address(0)) { revert CommonEventsAndErrors.InvalidAddress(); }
StakeInfo storage _stakeInfo = _stakeInfos[staker][index];
uint256 stakerBalance = _stakeInfo.amount;
_withdrawFor(_stakeInfo, staker, msg.sender, index, _stakeInfo.amount, claim, staker);
return stakerBalance;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.