# Exactly Protocol Update - Staking Contract audit contest Sherlock · Staking · 22nd July 2024 · #1 A public audit contest on Sherlock (staking), completed on 22nd July 2024. 0xSimao placed #1. 12 of his findings are published: 12 medium. ## What Exactly Protocol Update - Staking Contract is Exactly is a non-custodial fixed and variable rate lending protocol. The EXA staking program pays dividends from protocol revenue and adds voting power, and this update revises that machinery with the first round's fixes applied. ## Scope The updated EXA staking contract, reviewed against the first round's fixes. ## Medium severity findings - [Depositing to another receiver othan than `msg.sender` will lead to stuck funds by increasing `avgStart` without claiming](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-othan-stuck-increasing-avg) - [Liquidations will leave dust when repaying expired maturities, making it impossible to clear bad debt putting the protocol at a risk of insolvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidations-dust-debt-insolvency) - [Liquidator will leave a pool with unassigned earnings on `Market::clearBadDebt()` free to claim for anyone when the repaid maturity is not the last](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidator-clear-debt-repaid) - [Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-debt-cleared-accrual-solvency) - [Precision Loss in `notifyRewardAmount` Function Causes Unclaimable RewardToken](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-precision-notify-reward-unclaimable) - [Attackers will reset `avgStart` of any user making rewards stuck for longer and get lost to savings](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-avg-rewards-stuck-longer) - [Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-paused-harvested-deposits-yield) - [Setting a new market will make depositing to the market impossible when harvesting, DoSing deposits](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-impossible-harvesting-sing-deposits) - [Market utilization ratio near 100% will DoS deposits as harvest tries to withdraw and reverts](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-deposits-harvest-withdraw-reverts) - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little) - [Having no deposits in `StakedEXA` will lead to stuck rewards when harvesting](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-deposits-stuck-rewards-harvesting) - [Liquidating maturies with unassigned earnings will not take into account floating assets increase leading to loss of funds](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-liquidating-maturies-unassigned-floating) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/396)