Lines of code

Vulnerability details

configureLP function should check LP stakers existence before changing LP address.

Permitted users are allowed to change LP address when lpLocked is false. So this does not follow the comments above.

Proof of concept

1701	This function allows a permitted user to configure the LP token contract 
1702	address. Extreme care must be taken to avoid doing this if there are any LP 
1703	stakers, lest staker funds be lost. It is recommended that lockLP be 
1704	invoked.

1708	function configureLP (
1709			address _lp
1710		) external hasValidPermit(UNIVERSAL, CONFIGURE_LP) { //@@ address 0 check
1711			if (lpLocked) {
1712				revert LockedConfigurationOfLP();
1713			}
1714			LP = _lp;
1715		}

<https://github.com/code-423n4/2023-03-neotokyo/blob/main/contracts/staking/NeoTokyoStaker.sol#L1702&gt;

<https://github.com/code-423n4/2023-03-neotokyo/blob/main/contracts/staking/NeoTokyoStaker.sol#L1708&gt;

It’s better to check whether there are LP stakers or not before changing its address.

Tools Used

Vs code

Recommended Mitigation Steps

PoolData storage pool = _pools[AssetType.LP];
	if (pool.totalPoints != 0) { 
	
	revert LPstakerExist(); 
	}

Check the LP tokens totalPoints and if it is not 0 then revert the configureLP function. Consider adding this if check to configureLP function.

The text was updated successfully, but these errors were encountered:

All reactions