search

code-423n4 / 2022-05-backd-findings

0 stars 0 forks source link

Staking functions should be disabled if pool “killed” #147

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/AmmGauge.sol#L103

Vulnerability details

Impact

If pool is killed via kill(), the functions to stake and enter the pool should be paused/killed also.

Tools Used

Manual review

Recommended Mitigation Steps

Do not allow users to call stake() and stakeFor() when pool has already been killed.

GalloDaSballo commented 2 years ago

I agree with the finding, however I fail to see a vulnerability that entails loss of value or DOS given conditions.

Ultimately killed is more of a givingOutRewards check, and it does it's job. It does make sense to prevent deposits after the gauge has been killed, however I fail to see any risk in allowing it in the current system.

The lack of POC also doesn't show any impact

For those reasons I believe QA to be more appropriate