-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Operators can stake a vault more than once to a single DSS #94
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-61
grade-b
Q-03
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_20_group
AI based duplicate group recommendation
sufficient quality report
This report is of sufficient quality
Comments
howlbot-integration
bot
added
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
🤖_20_group
AI based duplicate group recommendation
bug
Something isn't working
duplicate-54
sufficient quality report
This report is of sufficient quality
labels
Aug 1, 2024
MiloTruck marked the issue as unsatisfactory: |
c4-judge
added
the
unsatisfactory
does not satisfy C4 submission criteria; not eligible for awards
label
Aug 11, 2024
MiloTruck marked the issue as not a duplicate |
c4-judge
removed
the
unsatisfactory
does not satisfy C4 submission criteria; not eligible for awards
label
Aug 11, 2024
MiloTruck removed the grade |
MiloTruck marked the issue as duplicate of #61 |
c4-judge
added
downgraded by judge
Judge downgraded the risk level of this issue
and removed
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
labels
Aug 11, 2024
MiloTruck changed the severity to QA (Quality Assurance) |
c4-judge
added
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
grade-b
labels
Aug 11, 2024
MiloTruck marked the issue as grade-b |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-61
grade-b
Q-03
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_20_group
AI based duplicate group recommendation
sufficient quality report
This report is of sufficient quality
Lines of code
https://github.com/code-423n4/2024-07-karak/blob/ab18e1f6c03e118158369527baa2487b2b4616b1/src/Core.sol#L130
Vulnerability details
Impact
Operators can request and finalize staking a vault more than once to a single DSS which will also allow spending unnecessary gas fee.
Proof of Concept
Add the below test function in
/test/core/operatorDSS.t.sol
and then run the test with this forge command.forge test --mt test_my_request_stake_update_request
Tools Used
Manual review
Recommended Mitigation Steps
Add a check for when the vault was already staked to a DSS by the operator.
Assessed type
Invalid Validation
The text was updated successfully, but these errors were encountered: