Skip to content
Request an audit

‹ Findings database

Checks effects interactions pattern is not always followed

Low/InfoSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-N04

Description

In StakingAssetManager::unlock(), fees are forwarded before marking the nullifier as used by calling _postWithdraw(). Although this is not exploitable because the call is permissioned by the relayer and it's not possible to register the same nullifier more than once, the pattern should always be followed to prevent future issues (if the code changes).

Recommendation

Forward the fees after recording all state changes.

Status

Addressed in #89d8e20, #189f399.