The function _accrueRewards is called anytime rewards needs to be accrued. The variable supplyTokens is the total supply of the reward token. deltaIndex is calculated by taking the accrued * 10** decimals() / supplyTokens, and rounded down. decimals() calculates the decimals of the staking Token.
If the decimal places of the staking token and reward token is different, ie DAI (18 decimals) and USDC (6 decimals) for staking and reward respectivevly, then the deltaIndex will be calculated incorrectly. It should take the decimals of the reward token instead of the staking token.
Lines of code
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/utils/MultiRewardStaking.sol#L406
Vulnerability details
Impact
Calculation of accrued rewards will be affected.
Proof of Concept
The function _accrueRewards is called anytime rewards needs to be accrued. The variable
supplyTokens
is the total supply of the reward token. deltaIndex is calculated by taking the accrued * 10** decimals() / supplyTokens, and rounded down. decimals() calculates the decimals of the staking Token.If the decimal places of the staking token and reward token is different, ie DAI (18 decimals) and USDC (6 decimals) for staking and reward respectivevly, then the deltaIndex will be calculated incorrectly. It should take the decimals of the reward token instead of the staking token.
Tools Used
VSCode
Recommended Mitigation Steps
Calculate using the decimals of the rewardToken instead of the staking token.