Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Underflow Vulnerability in Reward Calculation

silverwind

Summary

An underflow can occur when totalRewards is negative, causing the totalStaked to be an extremely large value. This bug allows for an incorrect calculation, leading to conditions where rewards or fees are not properly distributed.

Vulnerability Details

In the _updateStrategyRewards function, totalRewards is an int256 that accumulates deposit changes across strategies. If totalRewards becomes negative, the line:

totalStaked = uint256(int256(totalStaked) + totalRewards);

casts a potentially negative sum to uint256. This conversion does not throw an underflow error. Instead, it results in a very large number. The problem occurs when this inflated totalStaked value prevents the system from distributing rewards or fees properly, as seen in this line:

if (totalFeeAmounts >= totalStaked) {
totalFeeAmounts = 0;
}

if the totalStaked becomes an extremely large number, the condition is always false, blocking the fee distribution and possibly minting incorrect shares.

Impact

Fees might not be distributed to receivers. Also can cause imbalances in reward allocations and unfair reward distribution.

Tools Used

Manual Review

Recommendations

Always ensure that the calculation will not result in a negative totalStaked value.

if (totalRewards != 0) {
// Check for potential underflow before casting to uint256
+ int256 newTotalStaked = int256(totalStaked) + totalRewards;
+ require(newTotalStaked >= 0, "Underflow error: Negative totalStaked");
+ totalStaked = uint256(newTotalStaked);
- totalStaked = uint256(int256(totalStaked) + totalRewards);
}
...
​
if (totalFeeAmounts >= totalStaked) {
totalFeeAmounts = 0;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!