Open code423n4 opened 2 years ago
Duplicate
Switching this submission to be the primary for including PoC code & a clear description of the issue.
When unstaking, unvested tokens may become locked in the contract forever.
Accepting this as a High risk issue.
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L290-L325
Vulnerability details
Impact
Following scenario:
Alice has staked X token for 6 months that have vested. She stakes Y tokens for another three months. If she now calls
unstake(X)
to take out the tokens that have vested, the Y tokens she staked for three months will be locked up.Proof of Concept
First, here's a test showcasing the issue:
The test implements the scenario I've described above. In the end, the user got back their
amountStaked
tokens with theamountStaked2
tokens being locked up in the contract. The user has no tokens staked at the end.The issue is in the
_updateUserStakedAmounts()
function:Tools Used
none
Recommended Mitigation Steps
Don't set
userstakedAmounts.amount
to0
if none of its tokens are removed (vestedAmount == 0
)