First Flight #22: Steaking
First Flight #22
Beginner FriendlyFoundryDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect accounting staking logic in `stake` function causes user funds to be lost

skypper

Summary

Staking logic and balance management contains a critical issue where the staking logic doesn't accumulate stakes.

Vulnerability Details

The stake function overwrites the existing stake amount for a user:

self.usersToStakes[_onBehalfOf] = msg.value

This means that every time a user stakes, it replaces the previous stake amount with the new amount. This prevents users from adding to their existing stakes and only allows them to stake a new amount entirely. This can be problematic if users intended to increase their existing stake.

Impact

Users are unable to increase their existing stake and in case they attempt to increase it the old amounts are permanently locked in the contract with no way to retrieve them.

Proof of Concept

The following test case illustrates the issue:

function testIncreaseStake() public {
uint256 dealAmount = steaking.getMinimumStakingAmount();
_stake(user1, dealAmount, user1);
​
uint256 userStakedAmount = steaking.usersToStakes(user1);
uint256 totalAmountStaked = steaking.totalAmountStaked();
​
assertEq(userStakedAmount, dealAmount);
assertEq(totalAmountStaked, dealAmount);
​
_stake(user1, dealAmount, user1);
​
userStakedAmount = steaking.usersToStakes(user1);
totalAmountStaked = steaking.totalAmountStaked();
​
assertNotEq(userStakedAmount, 2 * dealAmount);
assertEq(totalAmountStaked, 2 * dealAmount);
​
vm.expectRevert();
steaking.unstake(2 * dealAmount, user1);
}

Tools Used

Manual Review

Recommendations

Update the staking logic to accumulate stakes by changing the line to:

- self.usersToStakes[_onBehalfOf] = msg.value
+ self.usersToStakes[_onBehalfOf] += msg.value
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Steaking::stake overwrites the msg.value into storage

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.