Skip to content
Request an audit

‹ All findings

In StakingAssetManager::lockERC20() the resulting note is created with asset instead of zkToken

Crit/HighSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-C01

ReportSource

Description

Users can transfer tokens to the StakingAssetManager in return for a note commitment of the corresponding zkToken. However, StakingAssetManager::lockERC20() builds the note using args.asset, which is the asset itself, which will lead to problems (will not be able to unlock).

Recommendation

Build the note using zkToken instead.

Status

Addressed in #ab8b4b9.