mediumLogic errorOther
Aleo: `delegated[]` state is not removed after it reaches zero, potentially leading to higher computational costs and DoS
- Payout
- $0
- Protocol
- Aleo
- Disclosed
- Jun 24, 2024
- Source
- sherlock
On the Aleo layer-1 finalize program, the `delegated[]` mapping holds credits delegated to validators, but the `remove_validator` path writes a zero value back to a key instead of deleting it, leaving entries permanently in storage. Because staking-reward comp …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.