♨️Rugability of a Poorly Implemented recoverERC20 Function in Staking Contracts

Overview:

In staking contracts, a common feature is the ability for the contract owner to recover accidentally sent ERC20 tokens. This is usually done through a function like recoverERC20, which allows the contract owner to withdraw tokens that are not meant to be part of the staking or rewards mechanism. However, if the function is not carefully implemented, it opens the door to rug pulls where the owner can maliciously or unintentionally drain the rewards token from the contract. This creates a scenario where users who have staked tokens and are expecting rewards can be left with nothing, as the contract owner has full control over withdrawing the reward pool.

---

Vulnerability: recoverERC20 Misuse

The recoverERC20 function is designed to allow the contract owner to withdraw tokens that might have been sent to the staking contract by mistake. However, if no safeguards are put in place, this function can also be used to withdraw the rewards tokens that have accumulated in the contract, effectively draining the rewards pool and rugging the legitimate stakers.

Example Vulnerable Code

// Example of a vulnerable recoverERC20 function
function recoverERC20(address tokenAddress, uint256 tokenAmount) external onlyOwner {
    // Vulnerable: No check if the token being recovered is the rewardsToken
    IERC20(tokenAddress).transfer(owner(), tokenAmount);
}

In this case, the function allows the contract owner to recover any ERC20 token from the contract, including the rewardsToken. This means that over time, as stakers accumulate rewards, the owner could simply withdraw all of the rewards using the recoverERC20 function, leaving legitimate stakers with nothing.

---

Impact of the Vulnerability

The primary impact of this vulnerability is the complete loss of rewards for stakers, as the owner has the ability to drain the rewards pool at any time. This not only results in financial loss for users but also damages the reputation of the staking platform, as it creates a clear rug pull scenario where users’ expectations of receiving rewards are undermined by the contract owner’s actions.

• Loss of Rewards: The staked rewards that users have earned over time can be fully withdrawn by the owner, making it impossible for stakers to receive their rightful rewards.

• Rug Pull Risk: The owner can execute a rug pull by draining the rewards pool, effectively leaving stakers with nothing. This makes the entire staking system unreliable and vulnerable to abuse.

• Admin Privilege Exploitation: Admin privileges without proper checks can be dangerous, as they allow the owner to perform actions that are detrimental to the user base without their consent or knowledge.