StakingRewards.sol withdraw() allows withdrawal of locked stakes without proper balance tracking
jasonhuan opened this issue · 1 comments
jasonhuan commented
In StakingRewards.sol L242, the withdraw()
function does not check how much a user's balance of LP tokens comes from the locked portion of stakes, and thus may allow a user to withdraw from their locked balance. When doing so, it subtracts the non-boosted amount from _boosted_balances
instead of the boosted, locked amount, and thus allows for people to manipulate their balance in the StakingRewards contract.
This bug has been reported by @samczsun.
Link to bug: