Description:Description\
In valut.stake, the function first checks AZERO amount shouldn't be less than self.data.minimum_stake. And then calls self.data.delegate_bonding to deposit the AZERO.
As defined in nomination-pools/src/lib.rs#L1996-L2047, the function will check if the amount is larger than MinJoinBond::<T>::get(), if the amount is not larger, the function will revert.
Attack Scenario\
Please consider the follow case:
There are two new nomination_agents: agent1 and agent2, agent1's weight = 1, and agent2's weight is 999. MinJoinBond is set as 1e12 AZERO.
Alice the user calls vault.stake to stake 100e12 AZERO, and within the call, the AZERO will be split as 1e11 AZERO for agent1, and 100e12 - 1e11 for agent2.
Because those two agents are new, and nomination_agents.staked will be zero, so nomination-pools.join will be called, and because the amount is less than MinJoinBond, the function will revert.
Github username: -- Twitter username: -- Submission hash (on-chain): 0x069a16e16f161e33010d2e70b8c13f31397a44717d9aae4a8a5cd461ec2f23bb Severity: medium
Description: Description\ In valut.stake, the function first checks AZERO amount shouldn't be less than
self.data.minimum_stake
. And then calls self.data.delegate_bonding to deposit the AZERO.In valut/data.delegate_bonding, the function calculates how many AZERO each nomination_agent should get, and than depost the AZERO using call_deposit
In nomination_agent/lib.deposit, when
nomination_agent.staked == 0
, the function will call joinAs defined in nomination-pools/src/lib.rs#L1996-L2047, the function will check if the amount is larger than
MinJoinBond::<T>::get()
, if the amount is not larger, the function will revert.Attack Scenario\ Please consider the follow case: There are two new nomination_agents: agent1 and agent2, agent1's weight = 1, and agent2's weight is 999.
MinJoinBond
is set as 1e12 AZERO. Alice the user callsvault.stake
to stake 100e12 AZERO, and within the call, the AZERO will be split as 1e11 AZERO for agent1, and 100e12 - 1e11 for agent2. Because those two agents are new, andnomination_agents.staked
will be zero, sonomination-pools.join
will be called, and because the amount is less thanMinJoinBond
, the function will revert.