Submission Details
Severity:
The steakPoints saving function does not decrease users points when they unstakes
Summary
The steakPoints saving function does not decrease users points when they unstakes.
Vulnerability Details
Because the backend server only watch for onchain events and increase user points up on their stakes.
If user stake and then unstake repeatly they will get a ton of steak points.
if (!steakPoints) {
steakPoints = new steakPointsModel({
walletAddress: onBehalfOf,
points: +ethers.formatEther(amount) * PRECISION,
});
} else {
steakPoints.points += +ethers.formatEther(amount) * PRECISION;
}
Impact
User can abuse to get ton of points. Making it unfair to other user.
Tools Used
Manual review
Recommendations
decrease steakPoints on user
unstake()add import past onchain events function ( because incase backend is down, users will lost their
steakPointssince it only increase if backend is up )
Updates
Lead Judging Commences
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Steaking server is not taking unstakes into account
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.