Open sherlock-admin4 opened 4 months ago
Valid, considering adding whitelists
1 comment(s) were left on this issue during the judging contest.
panprog commented:
high, depositRewards leaves some dust amounts which can accumulate and can be substantial for 6-8 decimals tokens
The protocol team fixed this issue in the following PRs/commits: https://github.com/Zivoe/zivoe-core-foundry/pull/260
The Lead Senior Watson signed off on the fix.
KingNFT
medium
depositReward()
with zero amount to get reward tokens stuck inZivoeRewards
contractsSummary
ZivoeRewards.depositReward()
has no access control, attackers can call it with zero amount ofreward
to get some reward tokens stuck in contract. The locked amount could be significant especially when reward tokens have small decimals such asUSDT/USDC/WBTC
.Vulnerability Detail
The issue arises due to precision loss on L233 and L237.
The following PoC shows two cases that
654 USDC
and6.6 WBTC
get stuck inZivoeRewards(stZVE)
contract after20
calls ondepositReward()
with zero amount ofreward
.The test log:
Impact
Fund get stuck in contract
Code Snippet
https://github.com/sherlock-audit/2024-03-zivoe/blob/d4111645b19a1ad3ccc899bea073b6f19be04ccd/zivoe-core-foundry/src/ZivoeRewards.sol#L228C14-L228C27
Tool used
Manual Review
Recommendation
Increasing the precision of
rewardRate
by1e18
.