Sherlock contest - static's results

Handle

static

Vulnerability details

Vulnerability details

Impact

If the SHER token performs a callback, such as in ERC-777 tokens, when performing transfers, the _sendSherRewardsToOwner function can be run multiple times to extract more rewards than should be available for a single NFT.

Proof of Concept

The attackers stakes Sherlock for the minimum period and transfer the NFT to a contract with a fallback that calls ownerRestake when called. Once the period is up, they call ownerRestake from the contract (using the fallback), which triggers multiple more ownerRestakes before returning. This causes the contract to call safeTransfer multiple times giving them more reward than they're entitled to.

Tools Used

N/A

Recommended Mitigation Steps

delete the sherRewards_[_id] prior to transferring the SHER token to the user.