search

code-423n4 / 2022-01-sandclock-findings

0 stars 0 forks source link

Race condition to withdraw funds #191

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pedroais

Vulnerability details

Impact

Users may have to wait more time than predicted to withdraw funds.

Proof of Concept

The vault's funds are distributed between the vault and the investment strategy but withdrawals come only from funds that are currently inside the vault. This means that multiple depositors (or one big depositor) may not be able to withdraw their funds at the same time.

-Alice and bob deposit 100 tokens each so the total balance is 200 -50% of the funds are invested -There are 100 tokens in the vault and 100 in the strategy -If bob withdraws his funds then Alice can't do it anymore and has to wait for her tokens to be brought back to the vault by the admins -This means if you're not one of the firsts to withdraw you may have to wait an arbitrary amount of time (dependant on admins) to get your tokens back

naps62 commented 2 years ago

@gabrielpoca isn't this actually a duplicate of https://github.com/code-423n4/2022-01-sandclock-findings/issues/76 ?

gabrielpoca commented 2 years ago

nope, they are different issues, but this is the one I was looking for, ty!

gabrielpoca commented 2 years ago

actually, you are correct