Open code423n4 opened 2 years ago
I do not consider this to be a duplicate of #29 because the warden in #29 does not mention this specific failure case. This is indeed an easy to encounter bug that can be triggered as the result of a user error or a frontend bug. Loss of all funds for the promotion would be the result.
Handle
WatchPug
Vulnerability details
https://github.com/pooltogether/v4-periphery/blob/0e94c54774a6fce29daf9cb23353208f80de63eb/contracts/TwabRewards.sol#L88-L116
In the current implementation of
createPromotion()
,_epochDuration
is allowed to be0
.However, when
_epochDuration = 0
, it will be impossible for users to claim the rewards, and the promotion creator won't be able to cancel it.PoC
createPromotion()
to create a promotion with the following parameters:USDC
10,000
0
10
100,000 USDC
was transferred from Alice to theTwabRewards
contract;claimRewards()
but the transaction always revert at_ticket.getAverageTotalSuppliesBetween()
->TwabLib.getAverageBalanceBetween()
due to div by 0.cancelPromotion()
to retrieve the funds, but it always reverts at_requirePromotionActive()
since the promotion already ended.As a result, Alice's
100,000 USDC
is frozen in the contract.Recommendation
Consider adding
require(_epochDuration > 0)
increatePromotion()
.