GoGoPool contest - cryptostellar5's results

Liquid staking for Avalanche.

General Information

Platform: Code4rena

Start Date: 15/12/2022

Pot Size: $128,000 USDC

Total HM: 28

Participants: 111

Period: 19 days

Judge: GalloDaSballo

Total Solo HM: 1

Id: 194

League: ETH

GoGoPool

Findings Distribution

Researcher Performance

Rank: 74/111

Findings: 1

Award: $68.09

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Labels

bug
2 (Med Risk)
satisfactory
duplicate-673

Awards

68.0946 USDC - $68.09

External Links

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/Staking.sol#L328

Vulnerability details

The restakeGGP() function is essentially performing the same task as stakeGGP() function.

The stakeGGP() function has a modifier whenNotPaused() which ensures the the function is not accessible when the contracts are paused. However restakeGGP() function which is also performing the same task does not implement the whenNotPaused() modifier. Although it has a modifier onlySpecificRegisteredContract() which allows only specific registered contracts to call it, still restaking can be done even when the contracts are paused. This is not advisable at all as transfer of funds can still take place when the contract is paused.

Implement whenNotPaused() modifier to the restakeGGP() function

#0 - c4-judge

2023-01-08T13:28:11Z

GalloDaSballo marked the issue as duplicate of #351

#1 - c4-judge

2023-01-29T18:15:30Z

GalloDaSballo marked the issue as duplicate of #673

#2 - c4-judge

2023-02-08T08:56:55Z

GalloDaSballo marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter