Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

1 Wei corner case can affect minted shares for fee amounts badly

demorextess

Summary

1 Wei corner case can affect minted shares for fee amounts badly

Vulnerability Details

In StakingPool.solcontract while updating the strategy rewards the minted shares for the fee receivers shares are minted in following way:

// safety check
if (totalFeeAmounts >= totalStaked) {
totalFeeAmounts = 0;
}
​
// distribute fees to receivers if there are any
if (totalFeeAmounts > 0) {
uint256 sharesToMint = (totalFeeAmounts * totalShares) /
(totalStaked - totalFeeAmounts); // @audit 1 wei corner case
_mintShares(address(this), sharesToMint);
​
uint256 feesPaidCount;
for (uint256 i = 0; i < receivers.length; i++) {
for (uint256 j = 0; j < receivers[i].length; j++) {
if (feesPaidCount == totalFeeCount - 1) {
transferAndCallFrom(
address(this),
receivers[i][j],
balanceOf(address(this)),
"0x"
);
} else {
transferAndCallFrom(address(this), receivers[i][j], feeAmounts[i][j], "0x");
feesPaidCount++;
}
}
}
}

It firstly checks the fee amount for safety and if it's higher or equal to staked amount it directly mint the shares for the receivers. But it's causing a vulnerability for 1 wei corner case. Total fee amount is calculated with following way and small precision loss is very likely in this kind of percentage calculations.

if (totalRewards > 0) {
receivers[receivers.length - 1] = new address[]();
feeAmounts[feeAmounts.length - 1] = new uint256[]();
totalFeeCount += fees.length;
​
for (uint256 i = 0; i < fees.length; i++) {
receivers[receivers.length - 1][i] = fees[i].receiver;
&> feeAmounts[feeAmounts.length - 1][i] =
(uint256(totalRewards) * fees[i].basisPoints) /
10000;
&> totalFeeAmounts += feeAmounts[feeAmounts.length - 1][i];
}
}

Due to small precision loss such as 1 wei. It can be lower than totalStaked amount with only 1 point difference and it will pass the security check.

Impact

Following calculation will mint extremely higher amount of shares. Both totalFeeAmounts and totalShares have their own decimal and dividing by 1 wei will cause extremely higher amount of shares. This will cause massive price drops for staked link tokens shares and loss of funds.

uint256 sharesToMint = (totalFeeAmounts * totalShares) /
(totalStaked - totalFeeAmounts); // @audit 1 wei corner case
_mintShares(address(this), sharesToMint);

Tools Used

Manual review

Recommendations

Be sure total staked - total fee amounts is higher than 1e18.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.