search

code-423n4 / 2022-04-badger-citadel-findings

0 stars 1 forks source link

users lose money in withdraw #194

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/StakedCitadel.sol#L808

Vulnerability details

r is only the withdrawer share in the contract balance but not in the money in the strategy contract. the wthdrawer won't get his share in the money in the strategy contract.

GalloDaSballo commented 2 years ago

Per the discussion in #210 I must categorically disagree, the warden is asking to insert a vulnerability in the system.

I also would like the warden to show an actual example of this happening as they seem to imply the invariants on withdrawal can be broken but they fail to show any evidence.

For those reasons I must disagree completely

jack-the-pug commented 2 years ago

Dup #183