Lines of code

Vulnerability details

Impact

If the contract does not have enough esLBR tokens to mint and transfer as rewards, users will not be able to claim their rewards even if they have earned them.

Proof of Concept

There is no check to ensure that the contract’s balance of esLBR tokens is sufficient to cover the reward amount before calling the mint function. If the contract’s balance of esLBR tokens is not enough, the mint function would fail, causing the getReward transaction to revert, and the user wouldn’t receive their rewards.

Tools Used

MAnual

Recommended Mitigation Steps

A check should be added before calling the mint function to ensure that the contract has enough esLBR tokens to cover the reward. The contract can check the balance of esLBR tokens using the IesLBR(esLBR).balanceOf(address(this)) function and compare it with the reward amount. If the balance is greater than or equal to the reward, the mint function can be safely called. Otherwise, the function should revert or handle the situation appropriately (e.g., distribute the available esLBR tokens proportionally to the users).
<https://github.com/seerether/lybra/blob/cc1845d79f88bc6668054bccef3bb628565a9441/lybramitigate31#L6-L8&gt;

Assessed type

Token-Transfer

The text was updated successfully, but these errors were encountered:

All reactions