Immunefi Audit CompetitionsVechain | Stargate Hayabusa
Reports by Severity
High
- 59316 - [SC - High] off by one unlocks infinite vtho reward drain from ghost stakes
- 59358 - [SC - High] off by one error in reward claim logic allows delegators to steal vtho for periods after delegation ended
- 59361 - [SC - High] off by one in claimabledelegationperiods allows claimrewards to pay for periods after delegation end over claim theft of unclaimed yield
- 59386 - [SC - High] fund freeze from double stake subtraction when validator exits
- 59421 - [SC - High] theft of unclaimed yield via incorrect period range calculation and lack of per user effective stake tracking
- 59443 - [SC - High] rithmetic underflow in effective stake accounting causes permanent loss of funds
- 59563 - [SC - High] exited delegators can claim rewards indefinitely after exit
- 59564 - [SC - High] double calling updateperiodeffectivestake during the exit flow makes unstake revert trapping staked vet
- 59615 - [SC - High] off by one error in period boundary check allows theft of unclaimed yield after delegation exit
- 59657 - [SC - High] delegators lose first reward period when delegating to pending validators
- 59665 - [SC - High] delegators can claim rewards beyond delegation end
- 59709 - [SC - High] post exit rewards overpayment theft of unclaimed yield due to misclamped claim window in stargate
- 59723 - [SC - High] double decrease after exit validator exited leads to underflow and permanent freeze
- 59727 - [SC - High] double decrease dos on exit permanent unstake revert
- 59730 - [SC - High] permanent dos users cannot unstake after double exit scenario
- 59733 - [SC - High] post exit delegations can drain future rewards
- 59742 - [SC - High] user funds get stucked in the contract when validators exits
- 59752 - [SC - High] off by one bug in claimabledelegationperiods allows claiming yield for periods after exit
- 59756 - [SC - High] exiting delegators stakes can be bricked permanently by the validator signaling an exit after them in the same period
- 59776 - [SC - High] exited delegators can over claim vtho rewards for post exit periods due to off by one error in claimabledelegationperiods
- 59802 - [SC - High] double subtraction of validator effective stake will permanently lock other delegators staked vet
- 59809 - [SC - High] user balances are permanently frozen in specific delegation scenarios
- 59850 - [SC - High] users funds stuck in the contract permanently
- 59863 - [SC - High] over claim of delegation rewards after exit
- 59866 - [SC - High] the delegator s rewards in period 1 cannot be claimed
- 59904 - [SC - High] it s possible to decrease twice delegator stake in certain conditions
- 59919 - [SC - High] loss of funds delegators can claim rewards for periods where they had no stake
- 59951 - [SC - High] in special cases delegatorseffectivestake may decrease twice and cause staked funds to become locked
- 60004 - [SC - High] double decrease effective stake bug in unstake
- 60019 - [SC - High] off by one in stargate sol claimabledelegationperiods lets exited nfts siphon validator rewards leading to protocol insolvency
- 60027 - [SC - High] stuck funds for the later delegators due to an edge case led to double decreasing effective stakes
- 60028 - [SC - High] a delegator who has requested an exit continues to accumulate rewards
- 60049 - [SC - High] double effective stake decrement locks delegators unstake reverts due to duplicate effectivestake decrements in exit flow
- 60069 - [SC - High] incorrect claimable period calculation leading to attacker keep claiming even after exiting the delegation
- 60080 - [SC - High] unstake exit requests can either lock funds or silently double deduct effective stake after validator exit
- 60081 - [SC - High] exited delegator can continue to accrue and claim delegation rewards
- 60102 - [SC - High] exited delegator could keep claiming rewards stealing them from active delegators which would then lead to freeze of funds
- 60125 - [SC - High] moving delegations from one validator to another validator will not be possible in exit case for validator 1
- 60150 - [SC - High] off by one in claim window lets exited delegations harvest post exit rewards
- 60151 - [SC - High] double reduction of effective stake can lead to stuck delegations
- 60154 - [SC - High] exited delegations can continue claiming vtho rewards for future periods
- 60169 - [SC - High] exited delegations can continue to claim rewards due to logic fall through in claimabledelegationperiods
- 60173 - [SC - High] the phantom claimable periods can permanently lock the staked vet for ended delegations
- 60192 - [SC - High] users can claim delegation rewards after exit endperiod has passed
- 60210 - [SC - High] during a validator exit users will be unable to unstake due to underflow
- 60265 - [SC - High] the attacker can still claim rewards after exiting from validator
- 60592 - [SC - High] users are unable to unstake under certain conditions
- 60586 - [SC - High] incorrect double reduction of effective stake in stargate sol
- 60575 - [SC - High] double subtraction of delegator effective stake on exit can freeze vet and break reward distribution
- 60557 - [SC - High] double decrement of effective stake in unstake leads to dos and permanent fund lock
- 60553 - [SC - High] the delegator and the validator both exiting consecutively could lead to underflow in the unstake and delegate and stuck staked vet
- 60548 - [SC - High] an exited delegator who has not unstaked or delegated to a validator will be dos ed if a validator exits
- 60534 - [SC - High] a delegator who signals exit and waits for the validator to finish its period can no longer withdraw in the unstake function causing permanent loss of funds
- 60533 - [SC - High] overlap which will lead to loss of fund
- 60516 - [SC - High] incorrect boundary check in claimabledelegationperiods allows claiming rewards beyond delegation end period
- 60506 - [SC - High] double delegatorseffectivestake decrease permanently prevents single nft from unstaking
- 60470 - [SC - High] double decrease of validator stake in stargate sol
- 60431 - [SC - High] unauthorized vtho reward claims after delegation exit
- 60429 - [SC - High] double decrease of effective stake prevents delegators from unstaking
- 60426 - [SC - High] rewards accounting off by one skipped double period exploit leads to direct loss of user funds via incorrect reward distribution theft of unclaimed yield misallocation of vt
- 60419 - [SC - High] double decrease of effective stake leads to dos and permanent loss of funds
- 60400 - [SC - High] off by one in claimabledelegationperiods lets claims beyond exit
- 60373 - [SC - High] incorrect effective stake decrement when validator exits causes permanent freezing of user stake
- 60372 - [SC - High] double decrement bug effective stake underflow permanently locks funds
- 60334 - [SC - High] unstake permanently reverts when validator exits after delegator exit double decrease of effective stake
- 60311 - [SC - High] double effective stake decrement freezes unstake permanently after validator exit
- 60310 - [SC - High] incorrect boundary check in claimabledelegationperiods allows claiming rewards beyond delegation end period
- 60298 - [SC - High] duplicate effectivestake decrement path bricks unstake re delegate
- 60282 - [SC - High] last delegators for an exited validator may be dosed from re delegating or unstaking due to incorrect accounting of period effective stake
Medium
- 59570 - [SC - Medium] access control bypass in unstake leads to permanent freezing of funds
- 59997 - [SC - Medium] claimrewards fails to update state for zero value periods causing permanent fund freeze in unstake
- 60241 - [SC - Medium] permanent freezing of staked funds caused by accumulation with zero rewards
- 60539 - [SC - Medium] critical withdraw dos zero reward validators cause permanent user fund lock via broken reward claim logic
- 60466 - [SC - Medium] maxclaimableperiodsexceeded lock zero reward backlog permanently locks nfts
Low
- 59795 - [SC - Low] free boosts for levels added after v3
- 59814 - [SC - Low] stargatenft sol addlevel function not implement updatelevelboostpriceperblock
- 59841 - [SC - Low] the newly added level cannot have its boost price set because the updatelevelboostpriceperblock function is not exposed
- 60079 - [SC - Low] critical historical state corruption via stale checkpoints leads to permanent loss of future yield
- 60171 - [SC - Low] levels added after deployment lack boost price initialization resulting in free boosting
- 60259 - [SC - Low] malicious user can bypass maturity period for newly added levels
- 60597 - [SC - Low] hasrequestedexit returns true for not just requested exits but also delegations that are already exited
- 60593 - [SC - Low] no mechanism to set boostpriceperblock for levels added after initialization
- 60578 - [SC - Low] zero boost fee for newly added levels lets users skip maturity for free and avoid paying intended vtho boost cost
- 60386 - [SC - Low] missing setter for boostpriceperblock after adding new nft levels can allow users to bypass intended staking boost
- 60318 - [SC - Low] zero cost boost bypass for new levels
- 60289 - [SC - Low] misconfigured level with maturityblocks 0 allows skip of maturity requirements and backrun minting
Insight
- 60149 - [SC - Insight] revised missing input validation in addlevels can break multiple staking tier invariant in startgatenft
- 59244 - [SC - Insight] missing event emission on critical state change
- 59411 - [SC - Insight] inconsistency in migratetokenmanager in terms of the permitted caller
- 59844 - [SC - Insight] incorrect and misleading events when adding levels in stargatenft
- 59993 - [SC - Insight] unnecessary call to get balance in mintinglogic boostonbehalfof
- 60023 - [SC - Insight] unchecked address 0 validator in unstake
- 60527 - [SC - Insight] delegationexitrequested event emits inconsistent exit period values
- 60525 - [SC - Insight] levelcirculatingsupplyupdated not emitted during supply changes
- 60450 - [SC - Insight] code optimizations and enhancemets for efficient gas usage in several functions
- 60335 - [SC - Insight] missing or misleading code comments causes confusion and may lead to unnecessary code changes
Reports by Type
Smart Contract
- 60149 - [SC - Insight] revised missing input validation in addlevels can break multiple staking tier invariant in startgatenft
- 59244 - [SC - Insight] missing event emission on critical state change
- 59316 - [SC - High] off by one unlocks infinite vtho reward drain from ghost stakes
- 59358 - [SC - High] off by one error in reward claim logic allows delegators to steal vtho for periods after delegation ended
- 59361 - [SC - High] off by one in claimabledelegationperiods allows claimrewards to pay for periods after delegation end over claim theft of unclaimed yield
- 59386 - [SC - High] fund freeze from double stake subtraction when validator exits
- 59411 - [SC - Insight] inconsistency in migratetokenmanager in terms of the permitted caller
- 59421 - [SC - High] theft of unclaimed yield via incorrect period range calculation and lack of per user effective stake tracking
- 59443 - [SC - High] rithmetic underflow in effective stake accounting causes permanent loss of funds
- 59563 - [SC - High] exited delegators can claim rewards indefinitely after exit
- 59564 - [SC - High] double calling updateperiodeffectivestake during the exit flow makes unstake revert trapping staked vet
- 59570 - [SC - Medium] access control bypass in unstake leads to permanent freezing of funds
- 59615 - [SC - High] off by one error in period boundary check allows theft of unclaimed yield after delegation exit
- 59657 - [SC - High] delegators lose first reward period when delegating to pending validators
- 59665 - [SC - High] delegators can claim rewards beyond delegation end
- 59709 - [SC - High] post exit rewards overpayment theft of unclaimed yield due to misclamped claim window in stargate
- 59723 - [SC - High] double decrease after exit validator exited leads to underflow and permanent freeze
- 59727 - [SC - High] double decrease dos on exit permanent unstake revert
- 59730 - [SC - High] permanent dos users cannot unstake after double exit scenario
- 59733 - [SC - High] post exit delegations can drain future rewards
- 59742 - [SC - High] user funds get stucked in the contract when validators exits
- 59752 - [SC - High] off by one bug in claimabledelegationperiods allows claiming yield for periods after exit
- 59756 - [SC - High] exiting delegators stakes can be bricked permanently by the validator signaling an exit after them in the same period
- 59776 - [SC - High] exited delegators can over claim vtho rewards for post exit periods due to off by one error in claimabledelegationperiods
- 59795 - [SC - Low] free boosts for levels added after v3
- 59802 - [SC - High] double subtraction of validator effective stake will permanently lock other delegators staked vet
- 59809 - [SC - High] user balances are permanently frozen in specific delegation scenarios
- 59814 - [SC - Low] stargatenft sol addlevel function not implement updatelevelboostpriceperblock
- 59841 - [SC - Low] the newly added level cannot have its boost price set because the updatelevelboostpriceperblock function is not exposed
- 59844 - [SC - Insight] incorrect and misleading events when adding levels in stargatenft
- 59850 - [SC - High] users funds stuck in the contract permanently
- 59863 - [SC - High] over claim of delegation rewards after exit
- 59866 - [SC - High] the delegator s rewards in period 1 cannot be claimed
- 59904 - [SC - High] it s possible to decrease twice delegator stake in certain conditions
- 59919 - [SC - High] loss of funds delegators can claim rewards for periods where they had no stake
- 59951 - [SC - High] in special cases delegatorseffectivestake may decrease twice and cause staked funds to become locked
- 59993 - [SC - Insight] unnecessary call to get balance in mintinglogic boostonbehalfof
- 59997 - [SC - Medium] claimrewards fails to update state for zero value periods causing permanent fund freeze in unstake
- 60004 - [SC - High] double decrease effective stake bug in unstake
- 60019 - [SC - High] off by one in stargate sol claimabledelegationperiods lets exited nfts siphon validator rewards leading to protocol insolvency
- 60023 - [SC - Insight] unchecked address 0 validator in unstake
- 60027 - [SC - High] stuck funds for the later delegators due to an edge case led to double decreasing effective stakes
- 60028 - [SC - High] a delegator who has requested an exit continues to accumulate rewards
- 60049 - [SC - High] double effective stake decrement locks delegators unstake reverts due to duplicate effectivestake decrements in exit flow
- 60069 - [SC - High] incorrect claimable period calculation leading to attacker keep claiming even after exiting the delegation
- 60079 - [SC - Low] critical historical state corruption via stale checkpoints leads to permanent loss of future yield
- 60080 - [SC - High] unstake exit requests can either lock funds or silently double deduct effective stake after validator exit
- 60081 - [SC - High] exited delegator can continue to accrue and claim delegation rewards
- 60102 - [SC - High] exited delegator could keep claiming rewards stealing them from active delegators which would then lead to freeze of funds
- 60125 - [SC - High] moving delegations from one validator to another validator will not be possible in exit case for validator 1
- 60150 - [SC - High] off by one in claim window lets exited delegations harvest post exit rewards
- 60151 - [SC - High] double reduction of effective stake can lead to stuck delegations
- 60154 - [SC - High] exited delegations can continue claiming vtho rewards for future periods
- 60169 - [SC - High] exited delegations can continue to claim rewards due to logic fall through in claimabledelegationperiods
- 60171 - [SC - Low] levels added after deployment lack boost price initialization resulting in free boosting
- 60173 - [SC - High] the phantom claimable periods can permanently lock the staked vet for ended delegations
- 60192 - [SC - High] users can claim delegation rewards after exit endperiod has passed
- 60210 - [SC - High] during a validator exit users will be unable to unstake due to underflow
- 60241 - [SC - Medium] permanent freezing of staked funds caused by accumulation with zero rewards
- 60259 - [SC - Low] malicious user can bypass maturity period for newly added levels
- 60265 - [SC - High] the attacker can still claim rewards after exiting from validator
- 60597 - [SC - Low] hasrequestedexit returns true for not just requested exits but also delegations that are already exited
- 60593 - [SC - Low] no mechanism to set boostpriceperblock for levels added after initialization
- 60592 - [SC - High] users are unable to unstake under certain conditions
- 60586 - [SC - High] incorrect double reduction of effective stake in stargate sol
- 60578 - [SC - Low] zero boost fee for newly added levels lets users skip maturity for free and avoid paying intended vtho boost cost
- 60575 - [SC - High] double subtraction of delegator effective stake on exit can freeze vet and break reward distribution
- 60557 - [SC - High] double decrement of effective stake in unstake leads to dos and permanent fund lock
- 60553 - [SC - High] the delegator and the validator both exiting consecutively could lead to underflow in the unstake and delegate and stuck staked vet
- 60548 - [SC - High] an exited delegator who has not unstaked or delegated to a validator will be dos ed if a validator exits
- 60539 - [SC - Medium] critical withdraw dos zero reward validators cause permanent user fund lock via broken reward claim logic
- 60534 - [SC - High] a delegator who signals exit and waits for the validator to finish its period can no longer withdraw in the unstake function causing permanent loss of funds
- 60533 - [SC - High] overlap which will lead to loss of fund
- 60527 - [SC - Insight] delegationexitrequested event emits inconsistent exit period values
- 60525 - [SC - Insight] levelcirculatingsupplyupdated not emitted during supply changes
- 60516 - [SC - High] incorrect boundary check in claimabledelegationperiods allows claiming rewards beyond delegation end period
- 60506 - [SC - High] double delegatorseffectivestake decrease permanently prevents single nft from unstaking
- 60470 - [SC - High] double decrease of validator stake in stargate sol
- 60466 - [SC - Medium] maxclaimableperiodsexceeded lock zero reward backlog permanently locks nfts
- 60450 - [SC - Insight] code optimizations and enhancemets for efficient gas usage in several functions
- 60431 - [SC - High] unauthorized vtho reward claims after delegation exit
- 60429 - [SC - High] double decrease of effective stake prevents delegators from unstaking
- 60426 - [SC - High] rewards accounting off by one skipped double period exploit leads to direct loss of user funds via incorrect reward distribution theft of unclaimed yield misallocation of vt
- 60419 - [SC - High] double decrease of effective stake leads to dos and permanent loss of funds
- 60400 - [SC - High] off by one in claimabledelegationperiods lets claims beyond exit
- 60386 - [SC - Low] missing setter for boostpriceperblock after adding new nft levels can allow users to bypass intended staking boost
- 60373 - [SC - High] incorrect effective stake decrement when validator exits causes permanent freezing of user stake
- 60372 - [SC - High] double decrement bug effective stake underflow permanently locks funds
- 60335 - [SC - Insight] missing or misleading code comments causes confusion and may lead to unnecessary code changes
- 60334 - [SC - High] unstake permanently reverts when validator exits after delegator exit double decrease of effective stake
- 60318 - [SC - Low] zero cost boost bypass for new levels
- 60311 - [SC - High] double effective stake decrement freezes unstake permanently after validator exit
- 60310 - [SC - High] incorrect boundary check in claimabledelegationperiods allows claiming rewards beyond delegation end period
- 60298 - [SC - High] duplicate effectivestake decrement path bricks unstake re delegate
- 60289 - [SC - Low] misconfigured level with maturityblocks 0 allows skip of maturity requirements and backrun minting
- 60282 - [SC - High] last delegators for an exited validator may be dosed from re delegating or unstaking due to incorrect accounting of period effective stake