60386 sc low missing setter for boostpriceperblock after adding new nft levels can allow users to bypass intended staking boost

Submitted on Nov 22nd 2025 at 03:57:19 UTC by @sedare for Audit Comp | Vechain | Stargate Hayabusaarrow-up-right

  • Report ID: #60386

  • Report Type: Smart Contract

  • Report severity: Low

  • Target: https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/tree/main/packages/contracts/contracts/StargateNFT/StargateNFT.sol

  • Impacts:

    • Contract fails to deliver promised returns, but doesn't lose value

    • Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Description

Brief/Intro

In the StargateNFT staking system,when a new level is added via addLevel,there is no public/external function for the LEVEL_OPERATOR_ROLE to set or update boostPricePerBlock.As a result,newly added levels default to a boostPricePerBlock of 0.Users staking NFTs at these levels can earn rewards without paying for boost periods,potentially bypassing intended staking mechanics.

Vulnerability Details

  • addLevel allows the LEVEL_OPERATOR_ROLE to create new NFT levels.

  • updateLevelBoostPricePerBlock exits in the Levels library but is not exposed in the public StargateNFT contract, meaning new levels cannot have boost prices set after creation.

  • Newly added levels default to boost price of 0.

  • Users staking on these levels can skip paying for boost rewards,effectively bypassing the staking boost mechanism.

  • The intended access control**(LEVEL_OPERATOR_ROLE)** cannot correct this after level creation.

Impact Details

  • Serverity: Medium (economic /design impact rather than direct theft)

  • Impact: Users may bypass intended staking mechanics,receiving boosts without cost.

  • This does not directly steal funds or break core contract logic but could affect protocol incentives and fairness.

References

[StargateNFT.sol#L302]https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/blob/e9c0bc9b0f24dc0c44de273181d9a99aaf2c31b0/packages/contracts/contracts/StargateNFT/StargateNFT.sol#L302)

Levels.sol#L88arrow-up-right

Levels.sol#180arrow-up-right

Proof of Concept

Proof of Concept

Was this helpful?