Beginner FriendlyFoundryDeFi
100 EXP
View results
Submission Details
Severity: low
Invalid

Access control Bypass in the `stake` function.

Description:

According to the Steaking Docs. The role of the steak protocol team multisig who is basically the owner of the steaking contract are only responsible for setting the vault address after the staking period ends. But then in the stake function it does not restrict the owner from staking ETH.

Impact:

The owner can potentially stake ETH, which could lead to conflicts of interest or unintended manipulation of the staking process, affecting the fairness and transparency of the protocol.

Recommended Mitigation:

Add a check in the stake function to ensure that the owner cannot stake ETH. This can be done by asserting that msg.sender is not the owner before proceeding with the staking logic.

Updates

Lead Judging Commences

inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.