Closed sherlock-admin2 closed 7 months ago
1 comment(s) were left on this issue during the judging contest.
takarez commented:
invalid according to sherlock rules on view function and for the fact that it has no secrity issue as that was done in the for loop
ydlee
medium
getDelegatorTotalLocked
return wrong value.Summary
Function
getDelegatorTotalLocked
miscalculated the total locked value of a delegator.Vulnerability Detail
The
totalValueLocked
is only added up for one validator, while it should be added up for all validators.https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L844-L858
Impact
Function
getDelegatorTotalLocked
does not calculate the correct total locked value of a delegator, breaking the contract functionality and confusing offchain monitor systems.Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L844-L858
Tool used
Manual Review
Recommendation
Use "+=" instead of "=" at L848.
Duplicate of #35