Griefing Attack by staking for any receipent

Lines of code Vulnerability details Impact Any user can grief attack and lock funds of victim by staking with victim address as recipient. Proof of Concept If warmup period is more than 1, it is possible to do this by staking with victim address as recipient with 1 wei amount, and increasing the...

Incorrect accounting results in loss of user stake

Lines of code InfinityStaker.solL116-L131 InfinityStaker.solL290-L325 Vulnerability details Impact In InfinityStaker.sol, when calling the unstake function updateUserStakedAmounts is called to readjust the user staked amounts. If a user stakes an amount in a duration and has an already vested amo...

The timestamp of the specified duration is reset after the position is added via stake().

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. I noticed that the stake amount change in stake is +=, which means that the project itself defaults to adding positions at the same duration, but the timestamp of the duration is overwritten by =...

User can accidentally permanently freeze the staked funds

Lines of code Vulnerability details User facing changeDuration function allows for setting any newDuration of a stake. However, only THREEMONTHS, SIXMONTHS and TWELVEMONTHS durations are visible to the system in all the subsequent logic. If a user accidentally sets any other duration, the...

If a new extra reward is added later, existing stakes will not be able to withdraw

Lines of code Vulnerability details Impact When the user stakes token, it iterates over all the extraRewards and adds to the user stake: function stakeuint256 amount public updateRewardmsg.sender returns bool ... //also stake to linked rewards for uint256 i = 0; i extraRewards.length; i++...

attacker or user can take advantage of percsion error and effect staking

Lines of code Vulnerability details uint256 unlockAt = block.timestamp + maxTime; unlock uninweeks can have precision issues because no floating point variables in solidity so if unlockat is 10.32 is 10 /week 3 it will 3 3 =9 instead of almost 4 weeks so users can unlock before the time they...

UpdateReward Modifier is brickable

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The private variable RewardTokens is an unbounded list of addresses that the modifier updateReward loops over and updates the state variable rewardTokenInfo. The gas consumption can become increasingly...

Reentrancy Bugs in GenericMinerV2

Lines of code Vulnerability details Impact No ETH reentrancy decreaseStake: makes external call releaseRewards and updates the state variables afterwards totalStake, updateBoost increaseStake: makes call to releaseRewards and updates state variables afterwards totalStake, updateBoost Recommended...

Function recoverERC20 in StakingRewards allows an owner to transfer out any token except stakingToken

Judge @GalloDaSballo has assessed the 1st item in QA Report 254 as Medium risk. The relevant finding follows: … Function recoverERC20 in StakingRewards allows an owner to transfer out any token except stakingToken. I see 2 problems with this: 1. It should also forbid transferring of rewardsToken,...

AmmGauge stake allows for reentrancy that can lead to stealing the contract balance

Lines of code Vulnerability details Impact Some ERC20 do allow for user's control of execution. For example, ERC777 has tokensReceived hook. This way, an ability to reenter can be executed with the usage of any such tokens. AmmGauge stake do not control for reentrancy and uses balance difference ...

function lockFunds in TopUpActionLibrary can cause serious fund lose. fee and Capped bypass. It's not calling stakerVault.increaseActionLockedBalance when transfers stakes.

Lines of code Vulnerability details Impact In function TopUpActionLibrary.lockFunds when transfers stakes from payer it doesn't call stakerVault.increaseActionLockedBalance for that payer so stakerVault.actionLockedBalancespayer is not get updated for payer and...

Unlimited reward minting with Function Transfer in StakerVault (updates balances before calling userCheckpoint)

Lines of code Vulnerability details Impact The bug in "StakerVault.transfer" function which is externally callable is that first it is updating the balance of sender and receiver then it calls ILpGaugelpGauge.userCheckpoint for those addresses. Function userCheckpoint use balance of address to...

Governance Voting Dis-proportionally Favours Users Who Stake And Vote After A Poll Has Been Created And Had Its Snapshot Taken

Lines of code Vulnerability details Impact Polls are created by targeting the receivecw20 function which is queried whenever the contract receives tokens. By setting the hook message to Cw20HookMsg::CreatePoll, the sender is able to create a poll, assuming the amount sent satisfies the minimum...

Delegations staked with a _to parameter not equal to the _delegator lose out on rewards

Lines of code Vulnerability details Impact If an account wishes to stake with a delegator that it did not create with the account, the delegator is unable to use the staked tickets and the tickets will sit idle in the TWABDelegator until the staker realizes that he/she gets no rewards and can onl...

Users’ staking rewards can get redeemed by other users

Lines of code Vulnerability details Can be medium or high: When a user deposits through ConvexStakingWrapper, the contract calls the MasterChef's deposit function and deposits to it with recipient = msg.sender, but the MasterChef actually updates the deposited amount of the ConvexStakingWrapper...

During stake or deposit, users would not be rewared the correct Concur token, when MasterChef has under-supply of it.

Lines of code Vulnerability details Impact During stake or deposit, users would not be transferred the correct Concur token, when MasterChef has under-supply of it. There is an assumption that MasterChef contract would own enough Concur tokens so as to distribute to users as reward, during deposi...

SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

Handle GreyArt Vulnerability details Impact When escalating claims, the documentation states that the protocol agent is required to pay and stake a certain amount for the process. If the covered protocol is proven correct, then the amount specified by the claim will be paid out. They will also...

DoS and stealing users' USDC

Handle OriDabush Vulnerability details Sherlock.sol An attacker can DoS the system and steal user's USDC if he manages to stake his USDC first i.e. minting token ID 1. It can be done by calling the initialStake with every amount let's say amount = 1 for example. Let's assume the lock period is...

Zero value shown for stake & price in SherBuy.viewCapitalRequirements() when SherAmount between 1~1000 SherTokens.

Handle 0xwags Vulnerability details Impact stakeusdc staked and priceusdc to be paid will display zerowhen SherAmt is between one - four digit for eg, 1-1000if SHERDECIMALS is used as the divisor. I'm sure there is no limitation on the amount of Sher that one can buy or is it that there should be...

Creating rewardTokens without streaming depositTokens

Handle bitbopper Vulnerability details Impact stake and withdraws can generate rewardTokens without streaming depositTokens. It does not matter whether the stream is a sale or not. The following lines can increase the reward balance on a withdraw some time after stake: // accumulate reward per...