Submission Details
Severity:
Should check weth address when deploying Steaking contract.
Summary
Should check weth address when deploying Steaking contract.
Vulnerability Details
As weth address is immutable, if the owner inputs the wrong address as weth, the users's eth will stuck in this steaking protocol when use call depositIntoVault.
Impact
Users' s eth will stuck in this steaking protocol when use call depositIntoVault.
The owner no ways dealing with this issues
Tools Used
Manual
Recommendations
When deploy the contract, check the _weth address. If want more more security, can add one funciton the owner can set the WETH address.
@deploy
def __init__(_weth: address):
assert _weth != ADDRESS_ZERO, STEAK__ADDRESS_ZERO
WETH = _weth
self.startTimestamp = block.timestamp
self.owner = msg.sender
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.