Submission Details
Severity:
Loss of ETH Due to Value Overwrite in Steaking.vy::stake() Function
Summary
The function Steaking.vy::stake() overwrites the previously staked value, leading to a user losing ETH.
Vulnerability Details
The function Steaking.vy::stake() uses the following code to record the staked value of each user:
def stake(_onBehalfOf: address):
...
self.usersToStakes[_onBehalfOf] = msg.value ---> This will overwrite the previous amount
...
Each time a user stakes their ETH, the function creates a new mapping instead of adding to the previous staked value, resulting in the loss of the earlier staked amount.
PoC
Add the following code to the end of Steaking.t.sol in the test folder:
function testOverwriteStakingAmount() public {
address alice = makeAddr("alice");
uint256 stakeAmount = 1 ether;
// Alice stakes 1 ETH for the first time
_stake(alice, stakeAmount, alice);
uint256 aliceStakedAmountFirst = steaking.usersToStakes(alice);
// Alice stakes an additional 1 ETH
_stake(alice, stakeAmount, alice);
uint256 aliceStakedAmountSecond = steaking.usersToStakes(alice);
// Check if the staked value remains the same, indicating it overwrote the previous value
assertEq(aliceStakedAmountFirst, aliceStakedAmountSecond);
}
Impact
Users will lose their previously staked ETH.
Tools Used
Recommendations
Update the Steaking.vy::stake() function with the following code:
@external
@payable
def stake(_onBehalfOf: address):
.....
- self.usersToStakes[_onBehalfOf] = msg.value ----> This will overwrite the previous amount rather than accumulating it.
+ self.usersToStakes[_onBehalfOf] += msg.value ----> This will accumulate the new value with the previous one.
.....
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
Steaking::stake overwrites the msg.value into storage
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.