Description:Description\
In the SingelTokenVirtualRewarderUpgradeable contract, the withdraw function is responsible for updating the token's balance and total supply. However, there is an issue where the checkpointLastIndex and balanceCheckpoints are not updated when an amount is withdrawn using withdraw() function. This can lead to inconsistencies in the checkpoint system, affecting the accuracy of balance tracking and reward calculations.
Attack Scenario\
Describe how the vulnerability can be exploited.
If the withdraw function checkpoints the balance and supply before, then it would overwrite the repetitive amounts /
The best way is changing the variables and then checkpointing them
Github username: -- Twitter username: -- Submission hash (on-chain): 0x7f942d0a184e0db6749745f4ffbe92ad891a19fddca1a25e56e166cb95e34b30 Severity: medium
Description: Description\ In the
SingelTokenVirtualRewarderUpgradeable
contract, thewithdraw
function is responsible for updating the token'sbalance
andtotal supply
. However, there is an issue where thecheckpointLastIndex
andbalanceCheckpoints
are not updated when anamount
is withdrawn usingwithdraw()
function. This can lead to inconsistencies in the checkpoint system, affecting the accuracy of balance tracking and reward calculations.Attack Scenario\ Describe how the vulnerability can be exploited.
Attachments
Proof of Concept (PoC) File
below is the withdraw() function,
as we can see here only the info.balance and Epoch is updated using the
_writeCheckpoints()
function.here the
_writeCheckPoints()
function calls theVirtualRewarderCheckpoints.writeCheckpoint
with only updated values ofepoch_
andinfo.balance
.Revised Code File (Optional)
update both the
checkpointLastIndex
andbalanceCheckpoints
before calling the_writeCheckpoints
inwithdraw()