Closed code423n4 closed 2 years ago
Removed use of safeTransfer function
also added 0 check in the update function
Agree this is best prevented. But it assumes a malicious owner and if they were to abuse this, it would devalue their own token. If unintentional, it could be promptly corrected. Lowering risk and merging with the warden's QA report #345
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L375-L377 https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L142
Vulnerability details
Impact
A user has the possibility to "rage-quit" staked tokens without having to wait for them to be fully vested (penalties apply).
But a (malicious) owner of the
InfinityStaker
contract is able to temporarily "pause" the rage quit functionalityInfinityStaker.rageQuit()
by changing the storage variableINFINITY_TREASURY
to the zero-address.InfinityStaker.rageQuit()
uses theINFINITY_TREASURY
variable to determine the recipient for the penalty tokens. As this variable is set toaddress(0)
andERC20.transfer
reverts for a zero-address recipient, the function reverts and the user is not able to rage-quit.Proof of Concept
InfinityStaker.updateInfinityTreasury
InfinityStaker.rageQuit
Tools Used
Manual review
Recommended mitigation steps
Add a zero-address check for
_infinityTreasury
inInfinityStaker.updateInfinityTreasury
.