Silvermist - addToPosition #_transferSupportingFeeOnTransfer should be called at the beginning of the function

[sherlock-admin2]

Silvermist

Medium

addToPosition #_transferSupportingFeeOnTransfer should be called at the beginning of the function

Summary

When staking, the protocol uses fee-on-transfer tokens and implements the _transferSupportingFeeOnTransfer function to return the transferred amount after fees are deducted. However, in the addToPosition function, the amountToAdd is checked before the transfer, leading to potential issues with zero transfers and incorrect avgDuration calculations.

Vulnerability Detail

When staking, the protocol takes care of using fee on transfer tokens by implementing the _transferSupportingFeeOnTransfer function that returns the transferred amount after the fees.

In addToPosition the amountToAdd before the transfer is used to check if the user is transferring more than 0 and the avgDuration is also caluclated with the amount with the fees.

The transfer happens after this, which creates two problems. A user can transfer a little amount that becomes 0 after fees, but the check to be > 0 will pass since it is done before the transfer. Also, avgDuration will be calculated with wrong amount because it uses the variable value before the transfer.

Impact

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/MlumStaking.sol#L397-L428

Tool used

Manual Review

Recommendation

Make the transfer at the beginning of the function and use the amount after the fees for checks and calculations.

Duplicate of #545