Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

there is no check for msg.value in createVault function #12

Open
hats-bug-reporter bot opened this issue Aug 21, 2023 · 1 comment
Open

there is no check for msg.value in createVault function #12

hats-bug-reporter bot opened this issue Aug 21, 2023 · 1 comment
Labels
bug Something isn't working invalid This doesn't seem right

Comments

@hats-bug-reporter
Copy link

Github username: @0xmahdirostami
Submission hash (on-chain): 0xbb7f1d95289a8649a1365a8429f6a907fed9380decd371b576aae79feeb2c216
Severity: high

Description:
Description
As mentioned in https://docs-v3.stakewise.io/for-developers/create-vault :
The security deposit of 1 gwei must be transferred with the call. This protects the vault stakers from the inflation attack.
BUT there is no check

Attack Scenario
attack Scenario mentioned in OpenZeppelin/openzeppelin-contracts#3706

Attachments

  1. Proof of Concept (PoC) File
    Not needed

  2. Revised Code File (Optional)

add check

if(msg.value < 1000000000){revert();}  //  1  gwei
@hats-bug-reporter hats-bug-reporter bot added the bug Something isn't working label Aug 21, 2023
@tsudmi
Copy link

tsudmi commented Aug 23, 2023

The more is deposited, the stronger is protection against inflation attack, so the deployer could do that in purpose.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant