Closed code423n4 closed 1 year ago
Picodes changed the severity to 2 (Med Risk)
MikeHathaway marked the issue as sponsor acknowledged
The impact described isn't sufficient to justify Medium severity in my opinion.
Picodes marked the issue as unsatisfactory: Insufficient proof
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L561-L598
Vulnerability details
Impact
Due to changes in interest rates, failure to process transactions in a timely manner may result in missing out on ideal rewards.
Proof of Concept
The calculation of the _clainRewards function involves interest rates, which are variable. If _updateBucketExchangeRates is not executed in a timely manner, the bucketRate read in the next step _calculateNextEpochRewards may not be what we want, which will affect the results of rewardsEarned.
Tools Used
vscode + foundry
Recommended Mitigation Steps
Control the execution of the function by using the condition "block.timestamp < expired".
Assessed type
MEV