Handle

xYrYuYx

Vulnerability details

Impact

UpdateGlobalExchangeRate has incorrect implementation when totalGlobalShares is zero.

If any user didn’t start stake, totalGlobalShares is 0, and every stake it will increase.
but there is possibility that totalGlobalShares can be 0 amount later by unstake or disable validator.

#Proof of Concept
This is my test case to proof this issue.

In my test case, I disabled validator to make totalGlobalShares to zero.
And in this case, some reward amount will be forever locked in the contract.
After disable validator, I mined 10 blocks, and 4 more blocks mined due to other function calls,
So total 14 CQT is forever locked in the contract.

Tools Used

Hardhat test

Recommended Mitigation Steps

Please think again when totalGlobalShares is zero.

The text was updated successfully, but these errors were encountered:

All reactions