Submission Details
Severity:
Attackers can withdraw what they never staked... Leading to loss of funds.
Summary
Attackers can withdraw what they never staked... Leading to loss of funds.
Vulnerability Details
Here is the withdrawfunction in TempleGoldStaking.sol:
function withdraw(uint256 amount, uint256 index, bool claim) external override {
StakeInfo storage _stakeInfo = _stakeInfos[msg.sender][index];
_withdrawFor(_stakeInfo, msg.sender, msg.sender, index, amount, claim, msg.sender);
}
The logic behind this function is so those who staked can call it to withdraw.
As seen above, practically anyone can call this withdrawal function; all they need to do is input the amount, index, and indicate true.
This way, an attacker can withdraw successfully from the contract without any hinderance without staking at all.
Impact
Loss of funds.
Tools Used
Manual review.
Recommendations
Only those who have staked should be able to withdraw.
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.