Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wipeout of Staking2Attack.sol in Challenge 5 is puzzling #20

Open
erosjohn opened this issue Dec 30, 2023 · 0 comments
Open

wipeout of Staking2Attack.sol in Challenge 5 is puzzling #20

erosjohn opened this issue Dec 30, 2023 · 0 comments

Comments

@erosjohn
Copy link

Taking the situation of feeExempt as an example:
wipeout = uint248((tokenBalance * rewardBalance + lastReward * stake) / (stake - tokenBalance))
The above expression is equivalent to:
(wipeout + rewardBalance) = (wipeout - lastReward) * stake / tokenBalance
The left side of the equation represents the total reward(including we added) we need to receive, which is correct.
But there seems to be a issue on the right side of the equation, it should be the actual reward through calling sendReward function.
It is calculated through the following code:

amount = _tokenInfo.totalReward - _stakerInfo.lastReward; // line-1
if (balance != 0) {
    amount = (amount * staked) / balance; 
}

As line-1 shows, actually wipeout shouldn't be _TokenInfo.totalReward, which should be _TokenInfo.totalReward -_ StacerInfo.lastReward. _tokenInfo.totalReward - _stakerInfo.lastReward means the value added by calling function addReward, which is wipeout.
So I think the correct equation may be (wipeout + rewardBalance) = wipeout * stake / tokenBalance, which can be used to derive the actual expression of wideout as (tokenBalance * rewardBalance) / (staked - tokenBalance).
Of course, it's also possible that I misunderstood. Please help me correct it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant