hats-finance / Kintsu-0x7d70f9442af3a9a0a734fa6a1b4857f25518e9d2

Smart contracts for Kintsu
Other
0 stars 0 forks source link

`vault.stake` might revert when `nomination_agent.staked==0` #57

Open hats-bug-reporter[bot] opened 1 month ago

hats-bug-reporter[bot] commented 1 month ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x069a16e16f161e33010d2e70b8c13f31397a44717d9aae4a8a5cd461ec2f23bb Severity: medium

Description: Description\ In valut.stake, the function first checks AZERO amount shouldn't be less than self.data.minimum_stake. And then calls self.data.delegate_bonding to deposit the AZERO.

In valut/data.delegate_bonding, the function calculates how many AZERO each nomination_agent should get, and than depost the AZERO using call_deposit

In nomination_agent/lib.deposit, when nomination_agent.staked == 0, the function will call join

As defined in nomination-pools/src/lib.rs#L1996-L2047, the function will check if the amount is larger than MinJoinBond::<T>::get(), if the amount is not larger, the function will revert.

Attack Scenario\ Please consider the follow case: There are two new nomination_agents: agent1 and agent2, agent1's weight = 1, and agent2's weight is 999. MinJoinBond is set as 1e12 AZERO. Alice the user calls vault.stake to stake 100e12 AZERO, and within the call, the AZERO will be split as 1e11 AZERO for agent1, and 100e12 - 1e11 for agent2. Because those two agents are new, and nomination_agents.staked will be zero, so nomination-pools.join will be called, and because the amount is less than MinJoinBond, the function will revert.

bgibers commented 1 month ago

Duplicate of #48 , thank you for your submission and best of luckšŸ”„