Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of check zero-value transfers in the `StakingPool::donateTokens` wich will cause confusion and undesirable behaviour.

0xrolko

Relevant GitHub Links

https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L433

Summary

User can donate zero token and unnecessary Updates totalStaked.

Vulnerability Details

The StakingPool::donateTokens function allows a user to make a donation to the pool, however if the donation token amount is zero (0); no tokens will be deposited in the pool, it will not receive any funds but the totalStaked storage variable will be updated and the DonateTokens event will be emitted insinuating that a donation has been made even though in reality no donation has been made:

function donateTokens(uint256 _amount) external {
// @audit missing check zero-value transfers
token.safeTransferFrom(msg.sender, address(this), _amount);
totalStaked += _amount;
emit DonateTokens(msg.sender, _amount);
}

Impact

Several undesirable impacts:

- Misleading Events: Emitting an event for a zero token donation could confuse users who see a log indicating they donated tokens, even though no actual donation took place.

- Unnecessary Updates to totalStaked: Incrementing totalStaked by zero does not change its value but may still trigger state changes and additional gas costs.

- Wasted Gas: A token transfer for zero value still incurs gas costs, even though no tokens are actually transferred.

Tools Used

Manual review.

Recommendations

function donateTokens(uint256 _amount) external {
+ require(_amount > 0, "Amount must be greater than zero");
token.safeTransferFrom(msg.sender, address(this), _amount);
totalStaked += _amount;
emit DonateTokens(msg.sender, _amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.