Loop condition may exclude current cycle from reward calculations

[hats-bug-reporter[bot]]

Github username: -- Twitter username: -- Submission hash (on-chain): 0xdb8b75c7a72867498e681dbf384e55bd1a7bee9c0c578cf2725c9b8f3966dbcf Severity: medium

Description: Description\

The loop in the _claimCvgCvxRewards function iterates through cycles to calculate and accumulate both CVG and CVX rewards.

https://github.com/hats-finance/Convergence---Convex-integration-0xb3df23e155b74ad2b93777f58980d6727e8b40bb/blob/246e3ac71f3f2e4ab7eded0f347ad8d070410262/contracts/Staking/Convex/StakingServiceBase.sol#L352

The loop condition nextClaimableCvx < actualCycle means that the loop will continue as long as nextClaimableCvx is less than the current actualCycle.

However, there might be a scenario where the user is eligible to claim rewards for the current cycle (actualCycle) as well. If nextClaimableCvx is equal to actualCycle, the loop condition nextClaimableCvx < actualCycle will not be satisfied, and the loop will exit without considering the rewards for the current cycle.

Here’s an example: • Suppose nextClaimableCvx is 10, and actualCycle is also 10. • The loop condition nextClaimableCvx (10) < actualCycle (10) will be false, and the loop will not execute even once. • This means that the function will not calculate or accumulate any rewards for cycle 10, even though the user might be eligible for rewards in that cycle.

To ensure that the function correctly handles the scenario where the user is eligible for rewards in the current cycle, the loop condition should be changed to nextClaimableCvx <= actualCycle.

This condition will allow the loop to execute when nextClaimableCvx is equal to actualCycle, ensuring that rewards for the current cycle are also considered and calculated if applicable.

Going back to the example:

• With the loop condition nextClaimableCvx (10) <= actualCycle (10), the loop will execute at least once. 
• The function will then calculate and accumulate any eligible rewards for cycle 10, if applicable. 

By changing the loop condition to nextClaimableCvx <= actualCycle, the function ensures that it correctly handles all eligible cycles, including the current cycle (actualCycle), for reward calculations. This prevents any potential missed or excluded rewards that the user might be entitled to.

[PlamenTSV]

Intentional. Users intentionally cannot claim for cycles that have not finished to protect from gaming the rewards.