Submitted by Trust, also found by hals and SpicyMeatball
The BlastOnboardingBoot contract contains the bootstraping funds. After launch it will start a reward staking pool and allow users to claim tokens into it. This is in the launch sequence:
Note that the code approves the staking pool towithdraw from the created LP.
The code also provisions setting of the staking contract to another one.
The issue is that this function lacks two actions:
As a result, owner which assumes changing to a new staking pool is perfectly safe, will in fact cause reverts when users try claiming in the new pool. It is still possible to revert back to the old staking pool, but in fact it will never be possible to migrate to a new pool as no other approve() call exists in the contract.
Loss of assumed functionality of the Onboarding contract in a highly-sensitive area.
141345 (Lookout) commented:
0xCalibur (Abracadabra) acknowledged and commented:
