Flare FAssets · FINDING NOTE
Exit rules needed protection across repeated updates
Reported as HarryBarz. View the public report
Published as an Insight in Immunefi’s FAssets mitigation review, report 54955.
1 min read
Page link
Summary
This mitigation-review submission examined whether revised withdrawal rules continued to protect collateral-pool participants as an agent changed the pool’s settings. Immunefi classified the observation as an Insight.
Root cause
The report describes a mismatch between the intended withdrawal protection and the rules governing changes to pool parameters. A limit on an individual update did not necessarily preserve the intended protection over time.
Attack scenario
An agent with authority over pool settings could change withdrawal requirements after participants had committed funds. The concern was whether permitted configuration changes could make an ordinary participant's exit impractical.
Impact
The submission describes a risk of disrupted withdrawals and griefing for stakers. Its concern is the protection available to existing participants when an agent changes the terms governing their exit.
Fix recommendation
Define withdrawal protections as conditions that must remain true across the entire settings lifecycle. Review sequences of permitted changes and test that existing participants retain the intended exit options.