Immunefi Audit CompetitionsFolks Finance: Staking Contracts
Reports by Severity
Low
- 69376 - [SC - Low] incorrect guard in setmigrationpermit prevents revocation after role removal breaking documented user control
- 69188 - [SC - Low] setmigrationpermit revoke blocked after migrator role revocation
- 69605 - [SC - Low] users cannot revoke migration authorization after role revocation contrary to documented behavior
- 69908 - [SC - Low] stale migration approvals cannot be revoked after role revocation and automatically reactivate on role re grant
- 69836 - [SC - Low] setmigrationpermit blocks users from revoking permits after role removal stale permits auto reactivate on re grant and drain user funds
- 69794 - [SC - Low] user cannot revoke migration approval if migrator loses migrator role
- 69966 - [SC - Low] cannot revoke migration permit after role revocation stale permits re activate on re grant
- 69097 - [SC - Low] broken migration permit revocation allows a re authorized migrator to transfer user principal and rewards without fresh consent
- 69410 - [SC - Low] migration permit cannot be revoked after migrator role removal
- 69650 - [SC - Low] setmigrationpermit blocks revocation after role revoke enabling stale consent reuse
- 69964 - [SC - Low] users cannot revoke migration permission after migrator role revocation
- 69814 - [SC - Low] stale migration permits cannot be revoked after migrator role removal
- 69423 - [SC - Low] Audit: Multiple authorization and migration bugs in Folks staking lead to direct theft, fund freezing, and operational failure
- 69275 - [SC - Low] protocol s explicit revoke at any time promise broken users cannot revoke migration consent during incident window
- 68955 - [SC - Low] unconditional hasrole check in setmigrationpermit authorization entrapment
- 69463 - [SC - Low] stale migration permits can be reactivated by re granting migrator role to a previously approved migrator
- 69738 - [SC - Low] setmigrationpermit prevents users from revoking stale permits after migrator role is revoked
- 69890 - [SC - Low] users won t be able to revoke migration permits from revoked migrators
- 69769 - [SC - Low] setmigrationpermit prevents users from revoking migration consent after migrator role is revoked
- 69956 - [SC - Low] Users Cannot Revoke Migration Permits After MIGRATOR_ROLE Is Revoked - Stale Permits Enable Unconsented Future Migrations
- 69860 - [SC - Low] users are permanently prevented from revoking migration permits if the migrator s role is temporarily or permanently revoked
- 69031 - [SC - Low] user cannot revoke permission from migrator if it does not have migrator role
- 69263 - [SC - Low] stale migration permit reactivation in folks finance staking contract
- 69345 - [SC - Low] migration permits cannot be revoked after migrator role is revoked despite readme claiming revocation is possible at any time
- 69100 - [SC - Low] permit irrevocability after migrator role revocation
- 69962 - [SC - Low] users cannot revoke migration permission during migrator role rotation window
- 69136 - [SC - Low] missing revocation condition in setmigrationpermit prevents users from revoking stale migration permissions violating documented protocol guarantee
- 69476 - [SC - Low] users cannot revoke stale migration approvals after a migrator is offboarded so old permits can silently reactivate
- 69756 - [SC - Low] staking setmigrationpermit unnecessary hasrole check on revocation blocks users from managing own permits
- 69898 - [SC - Low] stale migration approvals allow a re authorized migrator to move user positions without renewed consent
- 69396 - [SC - Low] users unable to remove migration permission from migrator who had role revoked
- 69141 - [SC - Low] setmigrationpermit revocation silently blocked for de listed migrators contradicting documented guarantee
- 69390 - [SC - Low] users cannot revoke migration permit at any time breaking documented guarantee
- 69505 - [SC - Low] user cannot revoke migration permit after migrator role is revoked
- 68903 - [SC - Low] users cannot revoke a migration permit after the migrator loses migrator role allowing stale approval to reactivate if the same address is re granted the role
- 69008 - [SC - Low] denial of service on migration permit revocation
- 69929 - [SC - Low] inability to revoke migrationpermits for revoked migrators leads to permanent state persistence of user approvals
- 69747 - [SC - Low] broken migration permit revocation allows stale user consent to reactivate after migrator role is re granted
- 69570 - [SC - Low] users cannot revoke migration approvals for removed migrators contrary to what the docs says
- 69527 - [SC - Low] users cannot revoke migration authorization after migrator role removal
- 69493 - [SC - Low] users cannot revoke permit for a role revoked migrator leading to residual permit risk if such migrator s role is ever reinstated
- 69524 - [SC - Low] role validation on revocation can lock migration permits
- 69673 - [SC - Low] users cannot revoke a migration permit after role removal
- 69936 - [SC - Low] users cannot revoke migration permits once the migrator s role has been revoked
- 69663 - [SC - Low] users cannot revoke previously granted migration permit after migrator role is revoked
- 69382 - [SC - Low] irrevocable migration permit users cannot revoke permit after migrator role revocation
- 69146 - [SC - Low] readme states migration permission can be revoked at any time but revocation becomes impossible after migrator role is removed
- 69678 - [SC - Low] lack of conditional role check in setmigrationpermit prevents users from revoking permits leading to unauthorized migration and theft of unclaimed yield
- 69926 - [SC - Low] users cannot revoke migration permits after migrator role is removed enabling fund migration without re consent
- 69777 - [SC - Low] setmigrationpermit does not deliver on specified functionalities
- 68994 - [SC - Low] users cannot revoke migration permits after migrator role is removed
- 69218 - [SC - Low] access control defect in setmigrationpermit leads to irrevocable stale migration permits
- 69278 - [SC - Low] migration permission can not be removed from the migrator if its migrator role is revoked in advance
- 69717 - [SC - Low] users are unable to revoke migration permits for deprecated or demoted migrators
- 69330 - [SC - Low] revoked migrators leave non revocable stale permits that reactivate on role re grant
Insight
- 68970 - [SC - Insight] insufficient event emission in migratepositionsfrom leads to loss of migration accounting visibility
- 69540 - [SC - Insight] missing return value on withdraw and missing view function for withdrawable amount
- 68906 - [SC - Insight] missing reentrancy guard on function recovererc20
- 69587 - [SC - Insight] recovered event missing recipient makes fund attribution impossible with multiple managers
- 68880 - [SC - Insight] missing reward parameter in staked event breaks off chain accounting
- 68983 - [SC - Insight] staketime field in userstake struct is stored but never used on chain wasting storage on every stake
- 68872 - [SC - Insight] copy paste typo in error parameter names
- 69245 - [SC - Insight] no view function to compute current claimable amounts
- 68995 - [SC - Insight] event parameter typo referer in staked event vs referrer in stakeparams struct
- 69870 - [SC - Insight] events emitted after external calls in recovererc20 and migratepositionsfrom violate cei pattern
- 68870 - [SC - Insight] reward calculation intermediate multiplication overflow
- 69420 - [SC - Insight] avoid the use of floating pragma to ensure same compiler version used for testing is also used for deployment
- 68849 - [SC - Insight] elapsed computed twice in withdraw code optimization
- 68879 - [SC - Insight] essential function declarations missing from istakingv1
- 69772 - [SC - Insight] after a revert stakewithpermit might be prevented
Reports by Type
Smart Contract
- 69376 - [SC - Low] incorrect guard in setmigrationpermit prevents revocation after role removal breaking documented user control
- 69188 - [SC - Low] setmigrationpermit revoke blocked after migrator role revocation
- 68970 - [SC - Insight] insufficient event emission in migratepositionsfrom leads to loss of migration accounting visibility
- 69605 - [SC - Low] users cannot revoke migration authorization after role revocation contrary to documented behavior
- 69908 - [SC - Low] stale migration approvals cannot be revoked after role revocation and automatically reactivate on role re grant
- 69836 - [SC - Low] setmigrationpermit blocks users from revoking permits after role removal stale permits auto reactivate on re grant and drain user funds
- 69794 - [SC - Low] user cannot revoke migration approval if migrator loses migrator role
- 69966 - [SC - Low] cannot revoke migration permit after role revocation stale permits re activate on re grant
- 69540 - [SC - Insight] missing return value on withdraw and missing view function for withdrawable amount
- 69097 - [SC - Low] broken migration permit revocation allows a re authorized migrator to transfer user principal and rewards without fresh consent
- 69410 - [SC - Low] migration permit cannot be revoked after migrator role removal
- 68906 - [SC - Insight] missing reentrancy guard on function recovererc20
- 69587 - [SC - Insight] recovered event missing recipient makes fund attribution impossible with multiple managers
- 69650 - [SC - Low] setmigrationpermit blocks revocation after role revoke enabling stale consent reuse
- 68880 - [SC - Insight] missing reward parameter in staked event breaks off chain accounting
- 69964 - [SC - Low] users cannot revoke migration permission after migrator role revocation
- 69814 - [SC - Low] stale migration permits cannot be revoked after migrator role removal
- 69423 - [SC - Low] Audit: Multiple authorization and migration bugs in Folks staking lead to direct theft, fund freezing, and operational failure
- 69275 - [SC - Low] protocol s explicit revoke at any time promise broken users cannot revoke migration consent during incident window
- 68983 - [SC - Insight] staketime field in userstake struct is stored but never used on chain wasting storage on every stake
- 68872 - [SC - Insight] copy paste typo in error parameter names
- 68955 - [SC - Low] unconditional hasrole check in setmigrationpermit authorization entrapment
- 69463 - [SC - Low] stale migration permits can be reactivated by re granting migrator role to a previously approved migrator
- 69738 - [SC - Low] setmigrationpermit prevents users from revoking stale permits after migrator role is revoked
- 69890 - [SC - Low] users won t be able to revoke migration permits from revoked migrators
- 69245 - [SC - Insight] no view function to compute current claimable amounts
- 69769 - [SC - Low] setmigrationpermit prevents users from revoking migration consent after migrator role is revoked
- 69956 - [SC - Low] Users Cannot Revoke Migration Permits After MIGRATOR_ROLE Is Revoked - Stale Permits Enable Unconsented Future Migrations
- 69860 - [SC - Low] users are permanently prevented from revoking migration permits if the migrator s role is temporarily or permanently revoked
- 69031 - [SC - Low] user cannot revoke permission from migrator if it does not have migrator role
- 69263 - [SC - Low] stale migration permit reactivation in folks finance staking contract
- 69345 - [SC - Low] migration permits cannot be revoked after migrator role is revoked despite readme claiming revocation is possible at any time
- 69100 - [SC - Low] permit irrevocability after migrator role revocation
- 68995 - [SC - Insight] event parameter typo referer in staked event vs referrer in stakeparams struct
- 69962 - [SC - Low] users cannot revoke migration permission during migrator role rotation window
- 69870 - [SC - Insight] events emitted after external calls in recovererc20 and migratepositionsfrom violate cei pattern
- 69136 - [SC - Low] missing revocation condition in setmigrationpermit prevents users from revoking stale migration permissions violating documented protocol guarantee
- 69476 - [SC - Low] users cannot revoke stale migration approvals after a migrator is offboarded so old permits can silently reactivate
- 69756 - [SC - Low] staking setmigrationpermit unnecessary hasrole check on revocation blocks users from managing own permits
- 68870 - [SC - Insight] reward calculation intermediate multiplication overflow
- 69898 - [SC - Low] stale migration approvals allow a re authorized migrator to move user positions without renewed consent
- 69396 - [SC - Low] users unable to remove migration permission from migrator who had role revoked
- 69141 - [SC - Low] setmigrationpermit revocation silently blocked for de listed migrators contradicting documented guarantee
- 69420 - [SC - Insight] avoid the use of floating pragma to ensure same compiler version used for testing is also used for deployment
- 68849 - [SC - Insight] elapsed computed twice in withdraw code optimization
- 69390 - [SC - Low] users cannot revoke migration permit at any time breaking documented guarantee
- 69505 - [SC - Low] user cannot revoke migration permit after migrator role is revoked
- 68903 - [SC - Low] users cannot revoke a migration permit after the migrator loses migrator role allowing stale approval to reactivate if the same address is re granted the role
- 69008 - [SC - Low] denial of service on migration permit revocation
- 69929 - [SC - Low] inability to revoke migrationpermits for revoked migrators leads to permanent state persistence of user approvals
- 69747 - [SC - Low] broken migration permit revocation allows stale user consent to reactivate after migrator role is re granted
- 69570 - [SC - Low] users cannot revoke migration approvals for removed migrators contrary to what the docs says
- 69527 - [SC - Low] users cannot revoke migration authorization after migrator role removal
- 69493 - [SC - Low] users cannot revoke permit for a role revoked migrator leading to residual permit risk if such migrator s role is ever reinstated
- 69524 - [SC - Low] role validation on revocation can lock migration permits
- 69673 - [SC - Low] users cannot revoke a migration permit after role removal
- 69936 - [SC - Low] users cannot revoke migration permits once the migrator s role has been revoked
- 69663 - [SC - Low] users cannot revoke previously granted migration permit after migrator role is revoked
- 69382 - [SC - Low] irrevocable migration permit users cannot revoke permit after migrator role revocation
- 69146 - [SC - Low] readme states migration permission can be revoked at any time but revocation becomes impossible after migrator role is removed
- 68879 - [SC - Insight] essential function declarations missing from istakingv1
- 69678 - [SC - Low] lack of conditional role check in setmigrationpermit prevents users from revoking permits leading to unauthorized migration and theft of unclaimed yield
- 69926 - [SC - Low] users cannot revoke migration permits after migrator role is removed enabling fund migration without re consent
- 69777 - [SC - Low] setmigrationpermit does not deliver on specified functionalities
- 68994 - [SC - Low] users cannot revoke migration permits after migrator role is removed
- 69218 - [SC - Low] access control defect in setmigrationpermit leads to irrevocable stale migration permits
- 69278 - [SC - Low] migration permission can not be removed from the migrator if its migrator role is revoked in advance
- 69717 - [SC - Low] users are unable to revoke migration permits for deprecated or demoted migrators
- 69772 - [SC - Insight] after a revert stakewithpermit might be prevented
- 69330 - [SC - Low] revoked migrators leave non revocable stale permits that reactivate on role re grant