First Flight #22: Steaking
First Flight #22
Beginner FriendlyFoundryDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Staking Amount Update (Root Cause: Overwriting Existing Stake)

princekay

Description

The stake() function in the provided code overwrites the existing staked amount for a user in the usersToStakes mapping. This can lead to loss of previously staked funds and incorrect tracking of the total amount staked.

Impact

When a user stakes additional funds, the function replaces the existing staked amount with the new amount, effectively erasing any previous stake. This can result in incorrect accounting of the total staked amount and loss of user's previously staked funds.

Proof of concept

  1. User A stakes 10 ETH.

  2. User A stakes another 5 ETH.

  3. The usersToStakes[User A] will now be 5 ETH, not 15 ETH, and the totalAmountStaked will be incorrect.

Recommended Mitigation:

Update the stake() function to add the new stake amount to the existing staked amount, rather than overwriting it. This can be done by modifying the line:

self.usersToStakes[_onBehalfOf] = msg.value;

to :

self.usersToStakes[_onBehalfOf] += msg.value;

This will preserve the existing staked amount and correctly update the total amount staked.

Tools Used

Manual review, vscode

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Steaking::stake overwrites the msg.value into storage

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.