highLogic errorEVM-Solidity
Elfi: Attacker can inflate stake rewards as he wants.
- Payout
- $0
- Protocol
- Elfi
- Disclosed
- Jun 20, 2024
- Source
- sherlock
Elfi's FeeRewardsProcess.updateAccountFeeRewards computed a staker's entitled fee rewards from the live ERC20 balance of the stake token on the account (line 63: IERC20(stakeToken).balanceOf(account)) rather than the staked amount recorded in the staking ledge …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.