The current staking level (voting power) for a given user is figured out by the function InfinityStaker.getUserStakeLevel based on defined thresholds.
However, the internal logic assumes the various levels to have their values defined in ascending order (BRONZE_STAKE_THRESHOLD < SILVER_STAKE_THRESHOLD < GOLD_STAKE_THRESHOLD < PLATINUM_STAKE_THRESHOLD).
Impact: Users have a wrong staking level, which results in incorrect voting power.
Proof of Concept
If the staking level values are completely mixed up and for instance, BRONZE_STAKE_THRESHOLD = 6000 and SILVER_STAKE_THRESHOLD = 4000, then a user with a totalPower = 5000 will have the staking level NONE, however, it should be SILVER_STAKE_THRESHOLD.
Consider adding a check to make sure the level values have the invariant BRONZE_STAKE_THRESHOLD < SILVER_STAKE_THRESHOLD < GOLD_STAKE_THRESHOLD < PLATINUM_STAKE_THRESHOLD enforced.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L351-L361 https://github.com/code-423n4/2022-06-infinity/blob/765376fa238bbccd8b1e2e12897c91098c7e5ac6/contracts/staking/InfinityStaker.sol#L213-L223
Vulnerability details
Impact
The current staking level (voting power) for a given user is figured out by the function
InfinityStaker.getUserStakeLevel
based on defined thresholds.However, the internal logic assumes the various levels to have their values defined in ascending order (
BRONZE_STAKE_THRESHOLD < SILVER_STAKE_THRESHOLD < GOLD_STAKE_THRESHOLD < PLATINUM_STAKE_THRESHOLD
).Impact: Users have a wrong staking level, which results in incorrect voting power.
Proof of Concept
If the staking level values are completely mixed up and for instance,
BRONZE_STAKE_THRESHOLD = 6000
andSILVER_STAKE_THRESHOLD = 4000
, then a user with atotalPower = 5000
will have the staking levelNONE
, however, it should beSILVER_STAKE_THRESHOLD
.InfinityStaker.updateStakeLevelThreshold
InfinityStaker.sol#L213-L223
Tools Used
Manual review
Recommended mitigation steps
Consider adding a check to make sure the level values have the invariant
BRONZE_STAKE_THRESHOLD < SILVER_STAKE_THRESHOLD < GOLD_STAKE_THRESHOLD < PLATINUM_STAKE_THRESHOLD
enforced.