hats-finance / Kintsu-0x7d70f9442af3a9a0a734fa6a1b4857f25518e9d2

Smart contracts for Kintsu
Other
0 stars 0 forks source link

funds are always remain in `NominationAgent` #31

Open hats-bug-reporter[bot] opened 1 month ago

hats-bug-reporter[bot] commented 1 month ago

Github username: @0xmahdirostami Twitter username: 0xmahdirostami Submission hash (on-chain): 0xfbea11e4b4edcba33cf047244fe121cf1ebd3dcda0135c6e7013da96f384aadf Severity: high

Description: Description: In the current implementation of NominationAgent, funds are not completely withdrawn when an owner attempts to remove an agent. After withdrawing all funds, rewards are distributed in following way:

            let incentive = balance * incentive_percentage as u128 / BIPS;
            let compound_amount = balance - incentive;
            self.staked += compound_amount;

            // Bond AZERO to nomination pool
            self.env()
                .call_runtime(&RuntimeCall::NominationPools(
                    NominationCall::BondExtra {
                        extra: BondExtra::FreeBalance {
                            balance: compound_amount,
                        }
                    }
                ))?;

            // Send incentive AZERO to vault which will handle distribution to caller
            if incentive > 0 {
                Self::env().transfer(vault, incentive)?;
            }

it means that the agent tries to stake balance-incentive again. so there is no way to withdraw all funds from the agent.

Impact: Loss of funds for the protocol and users.

Scenario:

  1. The owner wants to remove agent A.
  2. After withdrawing all funds, there is still some remaining balance.
  3. There is no mechanism to withdraw or transfer this remaining balance.

Revised Code File (Optional): Consider implementing a secondary function that allows the owner to withdraw funds or transfer them to another agent when removing an agent. This ensures that all funds are completely removed from the agent.

coreggon11 commented 1 month ago

From my observation it was only dust remaining

bgibers commented 1 month ago

From my observation it was only dust remaining

This should be the case. Thanks @coreggon11 💯