Neo Tokyo contest - 0x52's results

Lines of code

https://github.com/code-423n4/2023-03-neotokyo/blob/dfa5887062e47e2d0c801ef33062d44c09f6f36e/contracts/staking/NeoTokyoStaker.sol#L1597-L1644

Vulnerability details

Impact

LP can be unstaked while retaining the points associated with it

Proof of Concept

https://github.com/code-423n4/2023-03-neotokyo/blob/dfa5887062e47e2d0c801ef33062d44c09f6f36e/contracts/staking/NeoTokyoStaker.sol#L1621-L1631

PoolData storage pool = _pools[AssetType.LP];
unchecked {
	uint256 points = amount * 100 / 1e18 * lpPosition.multiplier / _DIVISOR; <- @audit-issue precision loss


	// Update the caller's LP token stake.
	lpPosition.amount -= amount;
	lpPosition.points -= points;


	// Update the pool point weights for rewards.
	pool.totalPoints -= points;
}

When calculating there is precision loss during the calculation because of the early division by 1e18. The result is that if amount < 1e16 then points will be 0. This means that the user stills receives their LP but doesn't lose the corresponding points. An adversary can abuse this by depositing then withdrawing their LP in small chunks so that their LP is unstaked but they still retain all their points.

Tools Used

Manual Review

Recommended Mitigation Steps

Change order of operations to prevent this precision loss:

    unchecked {
-       uint256 points = amount * 100 / 1e18 * lpPosition.multiplier / _DIVISOR;
+       uint256 points = amount * lpPosition.multiplier / 1e18;