StakingRewardsLP Manual Review Findings

SRL-01M: Improper Exit By Loss Implementation

Description:

If a user invokes the exitByLoss function with a non-zero boost, they will be unable to execute it successfully as the _balances[msg.sender] argument will always cause an underflow in the balances subtraction within withdraw.

Example:

Copy
222function exitByLoss() external {
223    withdraw(_balances[msg.sender]);
224    getRewardByLoss();
225}

Recommendation:

We advise the same argument as the exit function to be passed in here to ensure it will successfully execute under all circumstances.

Alleviation:

The GoGo team considered this exhibit but opted not to apply a remediation for it in the current iteration of the codebase.