persistenceOne / pStake-bugBounty

This repository is to record issues reported for the pStake bug bounty program.
3 stars 2 forks source link

Rewards claiming automatically #36

Open napelvs opened 3 years ago

napelvs commented 3 years ago

Describe the bug This bug was a headache but after hours of investigation, I finally have an explanation.

After claiming rewards and the Metamask transaction goes through, pSTAKE will automatically claim rewards without pressing anything. This usually happens in a 6-8 minutes timeframe. Performing a "claim rewards" transaction in this timeframe, messes up the entire application and results in lost funds (tokens under "unclaimed rewards" disappear). This may also result in a pending transaction on Metamask.

Here are my addresses, it could help to verify the transactions:

NOTE: This only started happening after I have made 1900 transactions over 4 days.

To Reproduce Steps to reproduce the behaviour:

  1. Go to pSTAKE application
  2. Wrap some ATOM tokens
  3. Stake some tokens
  4. Wait a few minutes to generate pATOMs under "unclaimed rewards"
  5. Press "Claim Now!" and proceed with the transaction
  6. After the transaction goes through, wait for 6-8 minutes
  7. pATOM tokens under "unclaimed rewards" will automatically be claimed

Expected behaviour Rewards shouldn't be claimed without the user's desire.

Desktop (please complete the following information):

Ethereum address 0x3f3eb8aad1b3c4a8184f82dc0e471b5641c6bfdc

Criticality Assessment Please pick one:

Checklist