Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

StakingRewards.sol withdraw() allows withdrawal of locked stakes without proper balance tracking #12

jasonhuan opened this issue Dec 10, 2020 · 1 comment


Copy link

jasonhuan commented Dec 10, 2020

In StakingRewards.sol L242, the withdraw() function does not check how much a user's balance of LP tokens comes from the locked portion of stakes, and thus may allow a user to withdraw from their locked balance. When doing so, it subtracts the non-boosted amount from _boosted_balances instead of the boosted, locked amount, and thus allows for people to manipulate their balance in the StakingRewards contract.

This bug has been reported by @samczsun.

Link to bug:

_staking_token_boosted_supply = _staking_token_boosted_supply.sub(amount);

Copy link
Contributor Author

This bug has been fixed in commit 7d699a8 with the implementation of StakingRewardsV2.sol.

20,000 FXS will be rewarded, subject to bug bounty rules and vesting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

No branches or pull requests

1 participant