Open code423n4 opened 2 years ago
This can only impact one user and only in an edge case so should be Medium severity.
The warden has shown how the first depositor may end up not getting the correct amount of points due to how zero is handled in poolCheckpoint
Am not fully confident this should be kept separate from #100
However at this time, I believe the finding to be of Medium Severity
At this time, while the underlying solution may be the same, I believe this finding and #100 to be distinct
Lines of code
https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/AmmGauge.sol#L56 https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/AmmGauge.sol#L140
Vulnerability details
Impact
The first staker within the
AmmGauge
may not get the rewards if the pool is not checkpointed right after he stakes and before he wants to claim the rewards.Proof of Concept
A testing environment that reproduces how the protocol is going to be deployed and managed is used to evaluate this case under the following assumptions and simplifications.
1) The inflation rate is fixed for simplicity (
0.001
). 2) For the testing environment performed by the team, a DummyERC20 was used as testing token. The same is done on the exploit environment. 3) The minting of tokens impact both on the inflation calculation and their balance. But this test evaluates the states just before minting (claimable balances). Following how the pools are updated, they are checkpointed in the end of the_executeInflationRateUpdate
call. Not while staking.In order to illustrate this scenario we will show both the vulnerable and non vulnerable situations.
Vulnerable Situation: 1) Alice, Bob, Charlie and David are future users of the pool. They all notice the inception of this project and decide to stake. 2) They all stake the same amount. Their transactions are mined with 1min of difference starting from Alice and finishing with David. 3) There is no external pool checkpoint between Alice and Bob (besides the one that is triggered when Bob stakes). 4) Sometime happens and they all want to check their accumulated reward balance. Alice accumulated much less than the others.
Non Vulnerable Situation:
_poolCheckpoint()
between Alice stake call and Bobs' and before checking the accumulated rewards.The code to show this has a
secureCheckpoints
toggle that can be set as true or false to trigger (or not) the intermediate poolCheckpoints.The outputs for both cases are shown on the following chart. The initial staking amount is 10eth amount of the DummyERC20 token.
Recommended Mitigation Steps