Platform: Code4rena
Start Date: 28/09/2023
Pot Size: $36,500 USDC
Total HM: 5
Participants: 115
Period: 6 days
Judge: 0xDjango
Total Solo HM: 1
Id: 290
League: ETH
Rank: 82/115
Findings: 1
Award: $4.37
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Bauchibred
Also found by: 0x3b, 0xDetermination, 0xMosh, 0xScourgedev, 0xTheC0der, 0xTiwa, 0xWaitress, 0xdice91, 0xfusion, 0xpiken, 0xprinc, 0xweb3boy, ArmedGoose, Aymen0909, Breeje, Brenzee, Daniel526, DavidGiladi, DeFiHackLabs, Flora, Fulum, HChang26, Hama, IceBear, J4X, Krace, KrisApostolov, Maroutis, Mirror, MohammedRizwan, Norah, PwnStars, SPYBOY, TangYuanShen, Testerbot, ThreeSigma, Tricko, al88nsk, alexweb3, ast3ros, berlin-101, bin2chen, blutorque, btk, d3e4, deth, e0d1n, ether_sky, ge6a, gkrastenov, glcanvas, hals, imare, inzinko, jkoppel, jnforja, joaovwfreire, josephdara, kutugu, lotux, lsaudit, mahdirostami, merlin, n1punp, nadin, neumo, nisedo, nobody2018, oakcobalt, orion, peanuts, pep7siup, pina, ptsanev, rokinot, rvierdiiev, said, santipu_, sashik_eth, seerether, squeaky_cactus, terrancrypt, tonisives, twicek, vagrant, xAriextz, y4y
4.3669 USDC - $4.37
Inconsistent State Transition After Burning Prime Tokens
In the prime contract, there is an inconsistency in the state transition of a user's reward index after burning prime tokens. Specifically, when a user burns their prime tokens by calling _burn(), the contract sets the user's rewardIndex
for all markets to zero. However, when the same user subsequently claims interest by calling _claimInterest(), the contract resets the rewardIndex to the current market's rewardIndex. This results in an inconsistent state transition.
Here is the sequence of events:
1) User burns prime tokens by calling `_burn()`. 2) `_burn()` sets the user's `rewardIndex` for all markets to zero. 3) Later, the same user calls `_claimInterest()` to claim interest. 4) `_claimInterest()` resets the user's `rewardIndex` to the current market's `rewardIndex`.
The inconsistency arises because, after burning prime tokens, the user's rewardIndex
should remain zero until they earn new rewards. However, _claimInterest()
incorrectly updates it to the current market's rewardIndex
maybe this issue could be considered as Medium
This will result in invalid accounting .
#0 - c4-pre-sort
2023-10-07T02:04:39Z
0xRobocop marked the issue as low quality report