rageQuit
function can be called when totalStaked
is 0
#315
Labels
bug
Something isn't working
disagree with severity
Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments)
duplicate
This issue or pull request already exists
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
sponsor acknowledged
Technically the issue is correct, but we're not going to resolve it for XYZ reasons
Lines of code
https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L193
Vulnerability details
Impact
Users can call rageQuit when there is nothing staked.
Proof of Concept
This part checks if
totalStaked
is more than and equal to 0.https://github.com/code-423n4/2022-06-infinity/blob/main/contracts/staking/InfinityStaker.sol#L193
totalStaked
is uint256, so require check always pass even thoughtotalStaked
is 0.getRageQuitAmounts
is used byrageQuit
function. Therefore, it is possible that users can callrageQuit
function whentotalStaked
is 0 which is not expected.Tools Used
static code analysis
Recommended Mitigation Steps
Fix the condition used at the require check. If
totalStaked
should not be zero, it can simply do like this:The text was updated successfully, but these errors were encountered: