BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Function 'deposit' does not take into account already deposited tokens

al88nsk

Description

Function BriVault::deposit does not take into account already deposited tokens by the user. If a user has already deposited and want to make another deposit to increase the shares, the stakedAsset mapping for the user will rewrite the value by the new deposit amount. If user cancels participation, the refunded amount will be only the new deposit amount. So, the user loses amount of tokens deposited at first time.

function deposit(uint256 assets, address receiver) public override returns (uint256) { // @audit donate attack
...
​
stakedAsset[receiver] = stakeAsset;
​
...
}

Risk

Likelihood:

Medium, since the issue has impact only in case when user makes several deposits and then cancels participation.

Impact:

High, since the user loses tokens

Recommended Mitigation

Increase the stakedAsset mapping value instead of rewriting it:

function deposit(uint256 assets, address receiver) public override returns (uint256) { // @audit donate attack
...
​
- stakedAsset[receiver] = stakeAsset;
+ stakedAsset[receiver] += stakeAsset;
​
...
}
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

`stakedAsset` Overwritten on Multiple Deposits

Vault tracks only a single deposit slot per user and overwrites it on every call instead of accumulating the total.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!