search

code-423n4 / 2021-10-union-findings

0 stars 0 forks source link

UserManager: totalStaked ≥ totalFrozen should be checked before and after totalFrozen is updated #47

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

itsmeSTYJ

Vulnerability details

Impact

The require statement in updateTotalFrozen and batchUpdateTotalFrozen to check that totalStaked ≥ totalFrozen should be done both before and after _updateTotalFrozen is called to ensure that totalStake is still ≥ totalFrozen. This will serve as a sanity check to ensure that the integrity of the system is not compromised.

GalloDaSballo commented 3 years ago

Agree with the finding and the recommendation of adding an additional require to ensure protocol invariants aren't broken