Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L811-L821
Ordinary traders are not aware that the contract does not have sufficient ajna tokens when receiving rewards, resulting in partial loss of ajna. Smart traders will check the contract token balance before claiming rewards, which leads to unfairness.
if (rewardsEarned > ajnaBalance) rewardsEarned = ajnaBalance;
This logic will cause traders to lose part of their rewards.
vsCode Foundry
Add a "debt" field to store debt information
mapping(address => uint256) internal debt;
Record every potential debt incurred.
function _transferAjnaRewards(uint256 rewardsEarned_) internal { // check that rewards earned isn't greater than remaining balance // if remaining balance is greater, set to remaining balance uint256 ajnaBalance = IERC20(ajnaToken).balanceOf(address(this)); //@audit rewardsEarned_ = rewardsEarned_ + debt[msg.sender]; if (rewardsEarned_ > ajnaBalance){ debt[msg.sender] = rewardsEarned_ - ajnaBalance; rewardsEarned_ = ajnaBalance; } else { debt[msg.sender] = 0; } if (rewardsEarned_ != 0) { // transfer rewards to sender IERC20(ajnaToken).safeTransfer(msg.sender, rewardsEarned_); } }
Other
Picodes marked the issue as duplicate of #361
Picodes marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L811-L821
Vulnerability details
Impact
Ordinary traders are not aware that the contract does not have sufficient ajna tokens when receiving rewards, resulting in partial loss of ajna. Smart traders will check the contract token balance before claiming rewards, which leads to unfairness.
Proof of Concept
if (rewardsEarned > ajnaBalance) rewardsEarned = ajnaBalance;
This logic will cause traders to lose part of their rewards.
Tools Used
vsCode Foundry
Recommended Mitigation Steps
Add a "debt" field to store debt information
Record every potential debt incurred.
Assessed type
Other