movementlabsxyz / movement

The Movement Network is a Move-based L2 on Ethereum.
Apache License 2.0
63 stars 60 forks source link

(HAL-01) STAKE SLASHING FEATURE IS COMMENTED #585

Open SA124 opened 3 weeks ago

SA124 commented 3 weeks ago

(HAL-01) STAKE SLASHING FEATURE IS COMMENTED

Auditor: Halborn Severity: Low

Description The MCR.sol contract presents a feature that allows to slash the stake of minority attesters during a block commitment proposal. However the actual line of code asking the staking contract to slash the stake is commented out. This can be an overlook from the developers and is reported informationally as such.

The minority being allowed to go against the consensus without losses can incentivize them to pursue their fraudulent activity, potentially harming the protocol and the users, committing bad blocks to the layer 1.

Screenshot 2024-09-12 at 12 04 59 PM

BVSS AO:A/AC:L/AX:M/R:N/S:C/C:N/A:M/I:N/D:N/Y:N (4.2)

Screenshot 2024-09-12 at 12 05 21 PM

Recommendation It is recommended to assess whether the logic is necessary and either keep the code or remove it.

l-monninger commented 2 weeks ago

Research.