highLogic errorEVM-Solidity
Gitcoin Passport: `userTotalStaked` invariant will be broken due to vulnerable implementations in `release()`
- Payout
- $0
- Protocol
- Gitcoin Passport
- Disclosed
- Apr 19, 2024
- Source
- code4rena
Gitcoin Passport's IdentityStaking contract enforces a documented invariant that a user's total staked balance equals the sum of their self-stake and all community-stake amounts. The release() function, which restores slashed funds after a successful appeal, i …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-03-gitcoin-findings/issues/9
- https://github.com/code-423n4/2024-03-gitcoin-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.