Issue 2

[Edward-Lo]

Description

There is a lack of sanity check in the getuintprofit method of flamingo staking contract, which might lead to unwanted behavior.

getuintprofit is a query function and returns currentUintStackProfit of the corresponding asset.

flamingo-contract-staking/StakingReocrd.cs

else if (method == "getuintprofit")
{
  var assetId = (byte[])args[0];

  var currentTotalStakingAmount = GetCurrentTotalAmount(assetId);
  var currentShareAmount = GetCurrentShareAmount(assetId);
  return currentShareAmount / currentTotalStakingAmount;
}

flamingo-contract-staking/GlobalRecordMethod.cs

private static BigInteger GetCurrentTotalAmount(byte[] assetId)
{
  var Params = new object[] { ExecutionEngine.ExecutingScriptHash };
  BigInteger totalAmount = (BigInteger)((DyncCall)assetId.ToDelegate())("balanceOf", Params);
  return totalAmount;
}

However, it lacks a sanity check for assetId. Users might accidentally pass any script which declared the balanceOf ABI, and leads to unwanted behaviors in the end.

Recommendation

flamingo-contract-staking/StakingReocrd.cs

else if (method == "getuintprofit")
{
  var assetId = (byte[])args[0];
  if (!IsInWhiteList(assetId) || assetId.Length != 20) return 0;
  
  var currentTotalStakingAmount = GetCurrentTotalAmount(assetId);
  var currentShareAmount = GetCurrentShareAmount(assetId);
  return currentShareAmount / currentTotalStakingAmount;
}