mediumLogic errorEVM-Solidity
Exactly Protocol Update - Staking Contract: Attackers will reset `avgStart` of any user making rewards stuck for longer and get lost to savings
- Payout
- $0
- Protocol
- Exactly Protocol Update - Staking Contract
- Disclosed
- Jul 25, 2024
- Source
- sherlock
Exactly's StakedEXA token tracks each holder's average staking start time via the avgStart mapping in _update(). Whenever the elapsed time since the last stake exceeds a reference threshold, avgStart is reset to the current block timestamp. Because the reset t …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.