Rage quit penalties can be set arbitrarily high by the InfinityStaker owner which allows the owner to steal funds from users who want to rage-quit.
Having the possibility to set unlimited high penalties does not put lots of trust into a protocol for investors (stakers). The penalty variables have the type uint16 and can therefore hold a value up to 65535.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L364-L372 https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L195-L198
Vulnerability details
Impact
Rage quit penalties can be set arbitrarily high by the
InfinityStaker
owner which allows the owner to steal funds from users who want to rage-quit.Having the possibility to set unlimited high penalties does not put lots of trust into a protocol for investors (stakers). The penalty variables have the type
uint16
and can therefore hold a value up to65535
.Proof of Concept
InfinityStaker.updatePenalties
Penalty values are used as follows:
InfinityStaker.getRageQuitAmounts
Penalty values up to
65535
will cause thetotalToUser
calculation to forfeit unvested tokens.Tools Used
Manual review
Recommended mitigation steps
Consider adding reasonable upper bounds for
THREE_MONTH_PENALTY
,SIX_MONTH_PENALTY
andTWELVE_MONTH_PENALTY
.