mediumLogic errorEVM-Solidity
Exactly Protocol Update - Staking Contract: Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming
- Payout
- $0
- Protocol
- Exactly Protocol Update - Staking Contract
- Disclosed
- Jul 25, 2024
- Source
- sherlock
Exactly's StakedEXA staking contract calls its internal reward-claiming routine for msg.sender whenever a new deposit is recorded in _update(), but credits the newly minted staked position to the `to` receiver rather than msg.sender. When a deposit is made to …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.