Closed sherlock-admin closed 7 months ago
1 comment(s) were left on this issue during the judging contest.
takarez commented:
invalid: admin function
check is done in _stake
Invalid, this check is performed in _stake()
as seen here. Additionally, this is purely a sanity check since this is a trusted admin action, wherein they can always pre-check a validators balance before hand.
Bauer
medium
The
enableValidator()
function does not check if the stake amount exceeds the maximum valueSummary
In the
enableValidator()
function, as theexchangeRate
might have changed, the protocol does not check if the stake amount exceeds the maximum value.Vulnerability Detail
In the
enableValidator()
function, the protocol only checks if the stake amount is greater than validatorEnableMinStake but does not check for validatorMaxStake, asexchangeRate()
might have changed.Impact
May exceed the maximum mint amount.
Code Snippet
https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/OperationalStaking.sol#L333-L348
Tool used
Manual Review
Recommendation
Check if staked is less than the maximum value.