M-05 MitigationConfirmed

[c4-bot-7]

Lines of code

Vulnerability details

Users can potentially control their losses because the era and draftEra can be increased independently in the seizeRSR function.

Mitigation

To mitigate this, governance can call the resetStakes function when the draftRate exceeds the safe range. This allows the governor to reset both the stakeRate and draftRate to 1 simultaneously, preventing users from manipulating their losses.

function resetStakes() external {
    _requireGovernanceOnly();
    require(
        draftRate <= MIN_SAFE_DRAFT_RATE ||
            draftRate >= MAX_SAFE_DRAFT_RATE ||
            stakeRate <= MIN_SAFE_STAKE_RATE ||
            stakeRate >= MAX_SAFE_STAKE_RATE,
        "rates still safe"
    );

    beginEra();
    beginDraftEra();
}

While this is not a perfect solution, as it relies on the governor properly executing the function, the likelihood and impact of the issue are low. Therefore, I have marked it as confirmed

[c4-judge]

thereksfour marked the issue as satisfactory

[c4-judge]

thereksfour marked the issue as confirmed for report