Submission Details
Severity:
First Depositor Incurs Loss in StakingPool
Summary
The first depositor in the staking pool incurs a loss of some tokens due to dead shares.
Vulnerability Details
The StakingPool implements the concept of dead shares to protect against inflation attacks, but the dead shares are being subtracted from the first depositor's shares, resulting in a small loss of shares for the first depositor.
function _mintShares(address _recipient, uint256 _amount) internal {
require(_recipient != address(0), "Mint to the zero address");
if (totalShares == 0) {
shares[address(0)] = DEAD_SHARES;
totalShares = DEAD_SHARES;
@>> _amount -= DEAD_SHARES;
}
totalShares += _amount;
shares[_recipient] += _amount;
}
Impact
A small loss for the first depositor due to the subtraction of dead shares.
Recommendations
Implement the concept of virtual shares as used in ERC4626 Vaults.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.