#39875 [BC-Critical] Lack of validation of node deactivation time in `ClaimRewards` allows to steal rewards

Submitted on Feb 9th 2025 at 16:44:04 UTC by @Blockian for Audit Comp | Shardeum: Core III

  • Report ID: #39875

  • Report Type: Blockchain/DLT

  • Report severity: Critical

  • Target: https://github.com/shardeum/shardeum/tree/bugbounty

  • Impacts:

    • Direct loss of funds

Description

Impact

User can falsely get very large rewards by reporting a false nodeDeactivatedTime in ClaimRewards.

Root Cause

The validation of ClaimRewards transaction lacks validation that nodeDeactivationTime is within bounds of the staking / active period of the node.

Attack Flow

  • A node stakes and becomes active in the network

  • The node calls InitRewardTime with its actual activation time

  • The node finishes being active

  • The node calls c with a large fake deactivation time

  • The reward is calculated according to the fake nodeDeactivationTime

  • The node calls InitRewardTime and ClaimRewards again with actual values

  • The node calls Ustake and receives all the reward

Suggested Fix

  • Validate nodeDeactivatedTime

Severity

This allows to mint extremely large amounts of the native token, and so is critical.

Proof of Concept

Proof of Concept

In the POC you can see a user staking and claiming rewards with a very large nodeDeactivatedTime and receiving rewards for the entire (fake) period.

  1. Apply the following changes on Shardeum

  1. Run a json-rpc-server

  2. Run the following attack script:

Was this helpful?