Staking cooldown can be avoided for a part of the funds

Lines of code Vulnerability details Impact Part of the stake can be withdrawn immediately at any time. Proof of Concept Ratio between COOLDOWNPERIOD and UNSTAKEPERIOD = 2 only and should be much higher ex 5 or 10 l.28 COOLDOWNPERIOD = 864000; // 10 days ... UNSTAKEPERIOD = 432000; // 5 days Vario...

User can always stay in UNSTAKE_PERIOD

Lines of code Vulnerability details Impact Due to how the cooldown period is calculated after a transfer, a user can strategically transfer between accounts to increase their cooldown timestamp while keeping it within the UNSTAKEPERIOD, so they can unstake anytime, defeating the cooldown mechanis...

Whole balance self transfer set user's cooldown to zero

Lines of code Vulnerability details Impact If a user transfers to self the whole balance, then user’s cooldown resets to zero. A user will have to reset its cooldown manually to current timestamp via cooldown call to be able to unstake in the future. As a transfer to self can happen by mistake an...

Malicious user can indefinitely freeze the funds of another user

Lines of code Vulnerability details Impact By design, a user's cooldown period is extended if they receive a transfer of hPal. The cooldown is extended based on the weight of the receiver's original balance and cooldown period compared to the sent amount and sender's cooldown period. Due to this...

cooldown is set to 0 when the user sends all tokens to himself.

Lines of code Vulnerability details Impact In the beforeTokenTransfer function, cooldowns will be set to 0 when the user transfers all tokens to himself. Consider the following scenario Day 0: The user stakes 100 tokens and calls the cooldown function Day 10: the user wanted to unstake the tokens...

Users can transfer tokens to themselves to set cooldowns to 0, and then increase the lock time of other users' tokens when transferring to other users

Lines of code Vulnerability details Impact In the beforeTokenTransfer function, cooldowns will be set to 0 when the user transfers all tokens to himself. function beforeTokenTransfer address from, address to, uint256 amount internal virtual override iffrom != address0 //check must be skipped on...

Cooldown and redeem windows can be rendered useless.

Handle ShippooorDAO Vulnerability details Impact Cooldown and redeem windows can be rendered useless. Proof of Concept Given an account that has not staked sNOTE. Account calls sNOTE.startCooldown Account waits for the duration of the cooldown period. Redeem period starts. Account can then deposi...

cooldown-project.com Improper Access Control vulnerability OBB-2296973

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...