TempleDAO / STAX Finance: Missing access control in migrateStake() — unvalidated oldStaking parameter

TempleDAO's STAX contract lost $2.3M when an attacker called a migration function with no access control and withdrew all LP tokens using a fake old-staking contract.

Occurred 2022-10-11 Loss $2M Status closed

Summary #

TempleDAO / STAX Finance suffered a Yield Vault / LP Staking on 2022-10-11, resulting in a loss of approximately $2M.

What happened #

TempleDAO's STAX contract lost $2.3M when an attacker called a migration function with no access control and withdrew all LP tokens using a fake old-staking contract.

Linked factors #

RD-F-001 — causal : ★ Audit scope mismatch — exploited code outside scope [via dashboard_risk_factors/Was exploited code in audit scope?: No — STAX staking contract was separate from audited Temple core vaults] || ★ Audit scope mismatch — full field name [via dashboard_risk_factors/Was exploited code in audit scope?: No — STAX staking contract was separate from audited Temple core vaults]
RD-F-004 — causal : Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (STAX staking contract)]
RD-F-006 — causal : Audit-deploy gap (RD-F-006 time between audit and deploy) [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — STAX was a newer application layer built atop TempleDAO, deployed June 2022] || Audit-deploy gap — alternate field name [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — STAX was a newer application layer built atop TempleDAO, deployed June 2022]
RD-F-126 — causal : Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: No — TempleDAO was an OHM-fork that had pivoted to FRAX stablecoin farming; STAX was original code]
RD-F-146 — related : New deploys in last 30 days — fresh attack surface [via dashboard_risk_factors/Exploited code newly deployed/upgraded?: Yes — STAX was a newer application layer built atop TempleDAO, deployed June 2022]