# Exactly Protocol Update - Staking Contract audit contest Sherlock · Staking · 22nd April 2024 · #1 A public audit contest on Sherlock (staking), completed on 22nd April 2024. 0xSimao placed #1. 11 of his findings are published: 2 high severity and 9 medium. ## What Exactly Protocol Update - Staking Contract is Exactly is a non-custodial fixed and variable rate lending protocol. Its staking program has EXA holders stake for dividends from protocol revenue and added voting power, with rewards scaling on stake duration. ## Scope The EXA staking program: the stEXA rewards accounting and its protocol integrations. ## High severity findings - [The Rounding Done in Protocol's Favor Can Be Weaponized to Drain the Protocol](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-rounding-favor-weaponized-drain) - [Unassigned pool earnings can be stolen when a maturity borrow is liquidated by depositing at maturity with 1 principal](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-unassigned-stolen-borrow-liquidated) ## Medium severity findings - [`TARGET_HEALTH` calculation does not consider the adjust factors of the picked seize and repay markets](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-factors-seize-repay-markets) - [`Market::liquidate()` will not work when most of the liquidity is borrowed due to wrong liquidator `transferFrom()` order](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-liquidate-borrowed-liquidator-transfer) - [Utilization rates are 0 when average assets are 0, which may be used to game maturity borrows / deposits / withdrawals](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-average-borrows-deposits-withdrawals) - [Liquidation does not prioritize lowest LTV tokens](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-liquidation-prioritize-lowest-ltv) - [Expired maturities longer than `FixedLib.INTERVAL` with unaccrued earnings may be arbitraged and/or might lead to significant bad debt creation](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-unaccrued-arbitraged-debt-creation) - [`rewardData.releaseRate` is incorrectly calculated on `RewardsController::config()` when `block.timestamp > start` and `rewardData.lastConfig != rewardData.start`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-reward-release-rewards-timestamp) - [Manipulation of the floating debt by updating `floatingBackupBorrowed`](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-manipulation-debt-backup-borrowed) - [Rewards can disappear when new rewards are distributed in the RewardsController.](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-rewards-disappear-distributed-controller) - [Profitable liquidations and accumulation of bad debt due to earnings accumulator not being triggered before liquidating](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-liquidations-accumulation-debt-accumulator) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/247)