search

code-423n4 / 2021-04-maple-findings

0 stars 0 forks source link

getRewardForDuration will start returning misleading results if rewardsDuration is updated #103

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

contract MplRewards function getRewardForDuration will start returning misleading results if rewardsDuration is updated (function setRewardsDuration) as rewardRate is not updated and is based on old rewardsDuration. This function is not used anywhere, I assume it is meant for frontend consumption. Anyway, I think it would make sense to return 0 if block.timestamp > periodFinish (which is the condition when owner can set new rewards duration).

Recommended Mitigation Steps

return 0 if block.timestamp > periodFinish.

lucas-manuel commented 3 years ago

Informational, won't address