Vulnerability in unstaking Neoxian Silver on Hive Engine...

in #vulnerability4 years ago

Since preparing the Hive nodes for latest hardfork, I noticed that some contracts, including Neoxian Silver, on Hive Engine are calculating staked balance incorrectly. Essentially it is possible to unstake about 10 times in quick succession as the staked balance is not subtracted by correct amount. In the end it leaves about 1/10th of the original staked balance. Obviously I didn't try to withdraw those tokens.

Sort:  

Apparently there was an update to the relevant contract right after my post that added/corrected cancelling invalid unstakes, but it did not fix the wrong staked balance displayed on Hive Engine, so unstaking is pretty much no-op if the staked balance is already out of sync and higher than the "real" staked balance of the token.