Submission Details
Severity:
Amounts < DEAD_SHARES will not receive shares
Vulnerability Details
In StakingPool.sol inherets from StakingRewardsPool and minting shares is dependent on _mintShares() internal function in which DEAD_SHARES are minted to address(0).
function _mintShares(address _recipient, uint256 _amount) internal {
require(_recipient != address(0), "Mint to the zero address");
if (totalShares == 0) {
shares[address(0)] = DEAD_SHARES;
totalShares = DEAD_SHARES;
_amount -= DEAD_SHARES;//@audit The minting
}
totalShares += _amount;?
shares[_recipient] += _amount;
//@audit missing event
}
The issue is that in the code it is subtracted from the _amount received, Hence any amount less than DEAD_SHARES amount will cause the function to revert.
Impact
Amounts < DEAD_SHARES will not receive shares
Tools Used
Manual review
Recommendations
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.