Exactly Protocol Update - Staking Contract audit contest

A public audit contest on Sherlock (staking), completed on 22nd July 2024. 0xSimao placed #1. 12 of his findings are published: 12 medium.

What Exactly Protocol Update - Staking Contract is

Exactly is a non-custodial fixed and variable rate lending protocol. The EXA staking program pays dividends from protocol revenue and adds voting power, and this update revises that machinery with the first round's fixes applied.

Scope

The updated EXA staking contract, reviewed against the first round's fixes.

Medium severity findings

• Depositing to another receiver othan than msg.sender will lead to stuck funds by increasing avgStart without claiming
• Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency
• Liquidator will leave a pool with unassigned earnings on Market::clearBadDebt() free to claim for anyone when the repaid maturity is not the last
• Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency
• Precision Loss in notifyRewardAmount Function Causes Unclaimable RewardToken
• Attackers will reset avgStart of any user making rewards stuck for longer and get lost to savings
• Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield
• Setting a new market will make depositing to the market impossible when harvesting, DoSing deposits
• Market utilization ratio near 100% will DoS deposits as harvest tries to withdraw and reverts
• Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards
• Having no deposits in StakedEXA will lead to stuck rewards when harvesting
• Liquidating maturies with unassigned earnings will not take into account floating assets increase leading to loss of funds

The contest

View the contest page