TempleGold

Summary

The _updatefunction allows users to transfer funds from one wallet to another one they own. But they can transfer more than what they have!

Vulnerability Details

This particular vulnerability is in the main TempleGold.sol contract.

The transfer process was not well-checked. Users can transfer more than what they have deposited or staked.

Note that they are transfering tokens from the contract, and not necessarily from their balances.

The contract assumes users will only try to withdraw less than or equal to what they have. Thereby, being unaware of malicious moves!

Impact

Users can by way of calling the updatefunction withdraw more than they should and possibly drain the contract since there is no check.

Tools Used

Manual review.

Recommendations

Check if the balance of the sender in* update function *matches the amount they want to send.