Platform: Code4rena
Start Date: 20/01/2022
Pot Size: $80,000 USDC
Total HM: 5
Participants: 37
Period: 7 days
Judge: Jack the Pug
Total Solo HM: 1
Id: 76
League: ETH
Rank: 11/37
Findings: 1
Award: $1,972.28
🌟 Selected for report: 0
🚀 Solo Findings: 0
hack3r-0m
https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/Sherlock.sol#L673
when intialStake is called, it mints the nft, and on before transfer hook, addressShares[msg.sender] is credited with minted shares
when redeemNFT is called, it burns the nft, and on before transfer hook, addressShares[msg.sender] is subtracted with burned shares.
while on arbRestake, some fraction of stakeShare is redeemed by arb but as there is no token transfer, that fraction is not deducted from addressShares of the owner hence resulting in improper amount and miscalculation in accounting.
until the owner does not call redeemNFT, correct calculation is not updated.
Manual Review
update addessShare of the owner on arbRestake
#0 - Evert0x
2022-02-09T17:44:10Z
#109