-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
0x73696d616f - Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield #35
Comments
Escalate I believe this issue should be low severity according to the following rule from the Sherlock docs:
|
You've created a valid escalation! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
The rule doesn't apply here because the concerns are in different contracts. It's not |
As I understand |
@WangSecurity the market is also a contract of the Exactly protocol. The relevant part is that each contract, Answering your question, the purpose of |
Can you share where you got this information from? I mean the fact that the users must be able to deposit at any time even if the market is paused/frozen, is it from README, code comments or docs? I don't see it in the first two, but I might be missing something? |
@WangSecurity EXA that is deposited in StakedEXA is not deposited in the market, it stays in the contract and accumulates rewards from the provider. The provider is the one that deposits in the market but this is external to StakedEXA. The contract is meant to lock liquidity and benefit users that hold their EXA. It would make sense to freeze deposits if a market is frozen if the EXA tokens were deposited to the market when deposited in StakedEXA, but it is not the case. Feel free to go through the StakedEXA code, nowhere does it deposit user deposits in the market. It only deposits the provider funds in the market to the savings when the provider gives allowance, but user EXA deposits stay in StakedEXA. Thus, as the EXA funds are not deposited in the market, deposits should not be DoSed when the market is frozen. |
@0xsimao as I understand, you mean that users should be able to deposit into StakedEXA at any moment in time, correct? Can you share what this understanding is based on? Is it documented or based on how the code functions (excuse me if a silly question, just don't see it in the code comments or README)? |
@WangSecurity yes, that is correct. The harvesting functionality should not DoS staking ever, there may be periods without new rewards from |
Thank you for these clarifications. I see how the concern about admin actions has got here. But, indeed, the users should be able to deposit in StakedEXA under any circumstances and when depositing into StakedEXA, users' funds indeed stay inside the contract and are not deposited inside the market. Additionally, both Market and StakedEXA have different admins and pausing functionalities. That's why I agree the rule shouldn't apply here and the issue should remain a valid medium. Planning to reject the escalation and leave the issue as it is. |
Result: |
Escalations have been resolved successfully! Escalation status:
|
The protocol team fixed this issue in the following PRs/commits: |
The Lead Senior Watson signed off on the fix. |
0x73696d616f
Medium
Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield
Summary
StakedEXA::harvest()
withdraws from themarket
of theStakedEXA
contract if the provider has assets there and has approvedStakedEXA
. However, the market may be paused/frozen, butStakedEXA::harvest()
will try to withdraw anyway, which will make it revert. As it is part of the deposit flow, it means all deposits will revert and new users will not be able to collect yield.Root Cause
In
StakedEXA::_update()
,StakedEXA::harvest()
is called if it is a mint (from == address(0)
), here. Then. inStakedEXA:harvest()
, it withdraws from themarket
regardless of its state, reverting if frozen or paused.Internal pre-conditions
None.
External pre-conditions
Attack Path
Impact
Frozen
StakedEXA
deposits which means new users will miss out on the yield and current users will enjoy a guaranteed higher yield.PoC
Add the following test to
StakedEXA.t.sol
confirming that deposits are halted when the market is paused.Mitigation
Check if the market is paused or frozen and do not harvest if this is the case.
The text was updated successfully, but these errors were encountered: