Ethereum Credit Guild - developerjordy's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/main/src/loan/SurplusGuildMinter.sol#L228-L234

Vulnerability details

Impact

When gaugeLoss is set previously in a term the block.timestamp is set as lastGaugeLoss for the term. When a user starts staking in a term that is previously set as lastGaugeLoss the userStake.lastGaugeLoss will have this timestamp. When a user unstakes this entry, it will still be marked as slashed, because it is not checked against the userStake entry. Resulting in lost of funds.

Proof of Concept

• Term is marked as lastGaugeLoss
  • Loss is applied
• Users start staking as term operates back as usual
  • userStake.lastGaugeLoss is set to block.timestamp the term is marked as loss
• getRewards method checks when Term gauge loss is applied
  • Checks this value against 0, as userStake.lastGaugeLoss is not yet defined. This happens at line 243.
• Slashed again and stakeEntry is lost.

Tools Used

Foundry

Recommended Mitigation Steps

To check the lastGaugeLoss against the UserStake, define userStake above the if statement

lastGaugeLoss = GuildToken(guild).lastGaugeLoss(term); 
+ userStake = _stakes[user][term];
if (lastGaugeLoss > uint256(userStake.lastGaugeLoss)) {
    slashed = true;
}

-userStake = _stakes[user][term];

Assessed type

Error