# SIP-0050 - Critical Staking Vulnerablity Fix **URL:** \ **Category:** SIP | Sovryn Improvement Proposals\ **Created:** [October 25, 2022, 4:25pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714 "2022-10-25T16:25:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![TJCloak](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@TJCloak](https://forum.sovryn.com/u/TJCloak)\ **Post date:** [October 25, 2022, 4:25pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/1 "2022-10-25T16:25:17Z")
Hello dear Sovryns. A security researcher has reported a critical vulnerability through Sovryn’s [Immunefi bug bounty program](https://immunefi.com/bounty/sovryn/). The vulnerability allows any address to obtain arbitrarily high voting power that would result in an unfair advantage in the Bitocracy voting system. The Exchequer Multisig has paused staking to allow us to expose the vulnerability publicly and to vote on the deployment and acceptance of the fix, without putting our governance at risk in the meantime. It is important to note that this vulnerability has not been exploited on mainnet to date. SIP-0050 introduces the fix we need to apply in order to protect the Staking contract from being exploited. We paused the Staking contract to prevent exploit of the vulnerability while the SIP is being discussed and voted, so your funds and voting power are safe. A draft sip: [SIPS/SIP-0050.md at SIP-0050 · DistributedCollective/SIPS · GitHub](https://github.com/DistributedCollective/SIPS/blob/SIP-0050/SIP-0050.md) Comments, questions are welcomed either here or on GitHub. ---
**Author:** ![Ingalandia](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.sovryn.com/ingalandia/32/10_2.png) [@Ingalandia](https://forum.sovryn.com/u/Ingalandia)\ **Post date:** [October 25, 2022, 6:41pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/2 "2022-10-25T18:41:49Z")
Has this fix been audited or reviewed, and if so, by whom? ---
**Author:** ![TJCloak](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@TJCloak](https://forum.sovryn.com/u/TJCloak)\ **Post date:** [October 26, 2022, 11:09am UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/3 "2022-10-26T11:09:02Z")
Internal review by 2 devs. ---
**Author:** ![Ingalandia](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.sovryn.com/ingalandia/32/10_2.png) [@Ingalandia](https://forum.sovryn.com/u/Ingalandia)\ **Post date:** [October 26, 2022, 6:56pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/4 "2022-10-26T18:56:19Z")
Honest question - is that enough? ---
**Author:** ![TJCloak](https://avatars.discourse-cdn.com/v4/letter/t/e95f7d/32.png) [@TJCloak](https://forum.sovryn.com/u/TJCloak)\ **Post date:** [October 27, 2022, 6:33am UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/5 "2022-10-27T06:33:51Z")
Yes. The fix is pretty straightforward. ---
**Author:** ![aaron023](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@aaron023](https://forum.sovryn.com/u/aaron023)\ **Post date:** [November 11, 2022, 6:20pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/6 "2022-11-11T18:20:08Z")
Has this update taken place and if so, when do staking rewards restart distribution as there is no change in my rewards tab and I was curious to know. ---
**Author:** ![Ororo](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.sovryn.com/ororo/32/352_2.png) [@Ororo](https://forum.sovryn.com/u/Ororo)\ **Post date:** [November 11, 2022, 7:54pm UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/7 "2022-11-11T19:54:37Z")
It has taken place, but the fee distribution is still stopped. We plan to reactivate it soon. ---
**Author:** ![jamescheuk](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.sovryn.com/jamescheuk/32/367_2.png) [@jamescheuk](https://forum.sovryn.com/u/jamescheuk)\ **Post date:** [November 20, 2022, 11:47am UTC](https://forum.sovryn.com/t/sip-0050-critical-staking-vulnerablity-fix/2714/8 "2022-11-20T11:47:19Z")
Spoiler alert. The contract was paused again.