Function InfinityStaker.updateStakeLevelThreshold allows updating stake threshold levels BRONZE, SILVER, GOLD and PLATINUM. Their values are expected to be set in increasing order which means that the following invariant should hold:
The issue is that function updateStakeLevelThreshold does not check for that invariant which might lead to incorrect reporting by getUserStakeLevel function and effectively loss of funds because of incorrect stake levels.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L351-L361
Vulnerability details
Impact
Function
InfinityStaker.updateStakeLevelThreshold
allows updating stake threshold levelsBRONZE
,SILVER
,GOLD
andPLATINUM
. Their values are expected to be set in increasing order which means that the following invariant should hold:The issue is that function
updateStakeLevelThreshold
does not check for that invariant which might lead to incorrect reporting bygetUserStakeLevel
function and effectively loss of funds because of incorrect stake levels.Proof of Concept
Tools Used
Manual Review / VSCode
Recommended Mitigation Steps
It is recommended to add
require
statements toupdateStakeLevelThreshold
function that will enforce invariant: