Exactly Protocol Update - Staking Contract audit contest

A public audit contest on Sherlock (staking), completed on 22nd April 2024. 0xSimao placed #1. 11 of his findings are published: 2 high severity and 9 medium.

What Exactly Protocol Update - Staking Contract is

Exactly is a non-custodial fixed and variable rate lending protocol. Its staking program has EXA holders stake for dividends from protocol revenue and added voting power, with rewards scaling on stake duration.

Scope

The EXA staking program: the stEXA rewards accounting and its protocol integrations.

High severity findings

• The Rounding Done in Protocol's Favor Can Be Weaponized to Drain the Protocol
• Unassigned pool earnings can be stolen when a maturity borrow is liquidated by depositing at maturity with 1 principal

Medium severity findings

• TARGET_HEALTH calculation does not consider the adjust factors of the picked seize and repay markets
• Market::liquidate() will not work when most of the liquidity is borrowed due to wrong liquidator transferFrom() order
• Utilization rates are 0 when average assets are 0, which may be used to game maturity borrows / deposits / withdrawals
• Liquidation does not prioritize lowest LTV tokens
• Expired maturities longer than FixedLib.INTERVAL with unaccrued earnings may be arbitraged and/or might lead to significant bad debt creation
• rewardData.releaseRate is incorrectly calculated on RewardsController::config() when block.timestamp > start and rewardData.lastConfig != rewardData.start
• Manipulation of the floating debt by updating floatingBackupBorrowed
• Rewards can disappear when new rewards are distributed in the RewardsController.
• Profitable liquidations and accumulation of bad debt due to earnings accumulator not being triggered before liquidating

The contest

View the contest page