Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Wrong event emited value for first minter in stakingPool::deposit

0xw3

Summary

A wrong event value is emited for first depositor of stakingPool::deposit, it emits a greater value than the actual shares minted for first staking user

Vulnerability Details

This is because the event emited doesnt account for the substracted shares deducted for the zero account.
StakingPool::deposit receives amount to mint for user

function deposit(
address _account, uint256 _amount, bytes[] calldata _data
) external onlyPriorityPool {
// ... snippet ...
if (_amount > 0) {
//... snippet
@=> _mint(_account, _amount);
}
}

And if amount is positive it will call StakingRewardsPool::_mint

function _mint(address _recipient, uint256 _amount) internal override {
=>[1] uint256 sharesToMint = getSharesByStake(_amount);
=>[2] _mintShares(_recipient, sharesToMint);

At [1] it will get how many shares to mint using getSharesByStake and
At [2] it will mint shares to recipient calling StakingRewardsPool::_mintShares, however, for the first recipient, DEAD_SHARES amount will be substracted for amount param and assigned to zero address

function _mintShares(address _recipient, uint256 _amount) internal {
if (totalShares == 0) {
=> shares[address(0)] = DEAD_SHARES;
=> totalShares = DEAD_SHARES;
=> _amount -= DEAD_SHARES;
}
totalShares += _amount;
shares[_recipient] += _amount;
}

Finally StakingRewardsPool::_mint will emit the event:

function _mint(address _recipient, uint256 _amount) internal override {
uint256 sharesToMint = getSharesByStake(_amount);
_mintShares(_recipient, sharesToMint);
​
console.log("\t[i] sharesToMint\t", sharesToMint);
=> emit Transfer(address(0), _recipient, _amount);
}

But the DEAD_SHARES is not substrated for amount argument
So a wrong event is emited for first depositor

Impact

Integrity loss, for integrator listening to emited events, external explorer UIs

Tools Used

Manual Review

Recommendations

Substract DEAD_SHARES for amount argument for emited event for first staker

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.