search

code-423n4 / 2021-12-pooltogether-findings

0 stars 0 forks source link

Reward stuck if promotion cancel before all past reward claimed #105

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

gzeon

Vulnerability details

Impact

When owner call cancelPromotion, the contract

  1. Delete the promotion struct (L132)
  2. Return all token reserved for future epochs (L133)

If there are token left for previous epochs, they will be stuck in the contract as the promotion struct is gone.

Proof of Concept

https://github.com/pooltogether/v4-periphery/blob/b520faea26bcf60371012f6cb246aa149abd3c7d/contracts/TwabRewards.sol#L119

Recommended Mitigation Steps

Set numberOfEpochs instead, i.e. _promotions[_promotionId].numberOfEpochs = _getCurrentEpochId(_promotion)+1;

PierrickGT commented 2 years ago

Duplicate of https://github.com/code-423n4/2021-12-pooltogether-findings/issues/23