60289 sc low misconfigured level with maturityblocks 0 allows skip of maturity requirements and backrun minting

Submitted on Nov 21st 2025 at 01:29:33 UTC by @MoZi for Audit Comp | Vechain | Stargate Hayabusaarrow-up-right

  • Report ID: #60289

  • Report Type: Smart Contract

  • Report severity: Low

  • Target: https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/tree/main/packages/contracts/contracts/StargateNFT/libraries/Levels.sol

  • Impacts:

    • Unintended economic advantage

Description

Brief/Intro

The protocol Levels::addLevel function allows the LEVEL_OPERATOR_ROLE to introduce new NFT levels. However, the function does not validate the _levelAndSupply.level.maturityBlocks input paramater, allowing a new level to be added with maturityBlocks = 0.

Vulnerability Details

Inside Levels::addLevel, the function validates only:

  • _levelAndSupply.level.name length

  • _levelAndSupply.level.vetAmountRequiredToStake input

  • _levelAndSupply.circulatingSupply

  • _levelAndSupply.cap

But no validation is applied to:

  • _levelAndSupply.level.maturityBlocks

  • _levelAndSupply.level.scaledRewardFactor

The currentStargate and StargateNFT contract does not implement the Levels::updateLevel from libraries to prevent when this scenario occur. It allowing user to backrun and mint the misconfigured level before protocol pause and upgrade the contract to implement function Levels::updateLevel. The updated level is only applies to the next minting and NFTs that have already been minted will not be affected.

This creates an unintended economic advantage for any user who immediately backruns the level addition and mints the NFT.

Impact Details

when LEVEL_OPERATOR_ROLE unintentionally sets maturityBlocks = 0, users can:

  • Immediately stake to mint the NFT

  • Receive an NFT that is already considered matured

  • Delegate instantly without waiting or paying boost

and if the added level is a level that has a high scaledRewardFactor then the user who immediately backruns and mints the NFT will get a huge advantage.

References

https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/blob/e9c0bc9b0f24dc0c44de273181d9a99aaf2c31b0/packages/contracts/contracts/StargateNFT/libraries/Levels.sol#L88

Proof of Concept

Proof of Concept

Step-by-step explanations:

  1. LEVEL_OPERATOR_ROLE call StargateNFT::addLevel and mistakenly sets maturityBlocks = 0.

  2. A user monitoring mempool detects the misconfiguration.

  3. User backruns or immediately call Stargate::stake(levelId) to mint the NFT.

  4. Minted NFT is exempt from the maturity requirement.

  5. User instantly call Stargate::delegate(TokenId) without waiting.

  6. The protocol cannot fix the misconfigured NFT Level without: pausing the contract, deploying upgrade , adding a new function for updateLevel.

Even though the misconfigured NFT level has been updated, the ones that have been minted will not change.

Was this helpful?