Magic Yearn MyStaking: setTimer runs before the fee divisor

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57531-stake-begin-time-updated-before-reward-calculation-in-mystak. Standalone Foundry PoC and full write-up: 57531-stake-begin-time-updated-before-reward-calculation-in-mystak_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/reward-calculation

Reproduction: faithful local reproduction of AuditVault 57531. stake calls setTimer before getDivisorByTime, so a long stake is charged the maximum fee.

Root cause#

stakeBegin is an input to getDivisorByTime. stake writes stakeBegin = block.timestamp before that read, so elapsed time is zero and the divisor is the maximum-fee value.

SOLIDITY

// @> VULN: stakeBegin is updated before getDivisorByTime prices the fee
setTimer(msg.sender);
uint256 divisor = getDivisorByTime(stakeBegin[msg.sender]);

A stake that began at timestamp 1, observed at timestamp 31536001, has elapsed a full year. The long-stake divisor is 100, a 10 MYR fee on 1,000 MYR. After setTimer the divisor is 10 and the fee is 100 MYR.

Attack path#

flowchart TD A["Seed stakeBegin at 1 and 1000 MYR pending"] --> B["Block time is one year later"] B --> C["stake calls setTimer first"] C --> D["getDivisorByTime sees elapsed zero"] D --> E["Fee is 100 MYR instead of 10 MYR"] E --> F["Staker receives 900 MYR and the sink takes 100"]

Impact#

The staker is overcharged 90 MYR on a 1,000 MYR reward. The fixed stake reads getDivisorByTime before setTimer and charges the 10 MYR long-stake fee, leaving the staker 990 MYR.

PoC#

BASH

cd 57531-stake-begin-time-updated-before-reward-calculation-in-mystak_exp
forge test -vv

Sources#

AuditVault finding 57531
Zokyo, Magic Yearn, 2022-08-17: https://github.com/solodit/solodit_content/blob/main/reports/Zokyo/2022-08-17-Magic%20Yearn.md

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 57531-stake-begin-time-updated-before-reward-calculation-in-mystak_exp (evm-hack-registry mirror).
AuditVault finding: 57531-stake-begin-time-updated-before-reward-calculation-in-mystak.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync