Venus Prime - aycozynfada's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L331-L359

Vulnerability details

Impact

The issue() function for minting prime tokens only deletes staked time for revocable tokens, but doesn't delete staked time for newly issued irrevocable tokens. Thereby Enabling the minting of multiple irrevocable tokens on the same stake which can allow a user to accumulate multiple rewards based on a single stake.

Proof of Concept

When a user is issued a new prime token after staking for a sufficient amount of time, the 'stakedAt[users[i]]' mapping for users should be deleted or zeroed to prevent a re-issuance of prime tokens based on the same stake.

Although the staked time of users was deleted after issuing revocable tokens, https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L348-L359

it wasn't deleted or zeroed for irrevocable tokens issuance, https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L331-L346

This can lead to a situation whereby a user accumulates and withdraw multiple rewards based on just a single stake, eventually hindering other users from getting their rewards.

Tools Used

Manual review

Recommended Mitigation Steps

'delete stakedAt[users[i]];' should be used to reset stake records after issuing irrevocable tokens.

Assessed type

DoS