mediumLogic errorEVM-Solidity
Kintsu: unsynced `staked` value when unbond open for DOS
- Payout
- $0
- Protocol
- Kintsu
- Disclosed
- May 25, 2024
- Source
- hats
Kintsu's substrate/ink! staking vault tracks a cached `staked` balance that is only decremented within its own `start_unbond` function. However, the underlying NominationPools `Unbond` call can be invoked permissionlessly by any external party when a pool is u …
Similar reports
- No close matches yet.
References
- https://github.com/hats-finance/Kintsu-0x7d70f9442af3a9a0a734fa6a1b4857f25518e9d2/issues/63
- https://github.com/hats-finance/Kintsu-0x7d70f9442af3a9a0a734fa6a1b4857f25518e9d2
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.