Open kalos-security opened 1 year ago
this issue is fixed in commit https://github.com/meterio/meter-pov/commit/47abc0cebea299fb965eb449f7eda29089abb2a9
@simonzg TotalVotes should also be updated. If TotalVotes is not updated, the reward calculation will have problems.
@simonzg We apologize for the confusion regarding TotalVotes. Upon further review, we have identified that the handling of TotalVotes is indeed done in the AddBucket and SubBucket functions.
[METER-LSD-09] BucketUpdateCandidate does not update the candidate's buckets
Impact
After the bucket's candidate has been updated to a different candidate, the new candidate's existing buckets/delegators will receive fewer rewards, as the new candidate's total votes (the denominator for calculating shared rewards) will be added.
Description
The following BucketUpdateCandidate code subtracts the bucket's
TotalVotes
from the original candidate'sTotalVotes
. It adds it to the new candidate'sTotalVotes
but does not remove the bucket from the original candidate's bucket list. It does not add the bucket whose candidate is being updated to the new candidate's bucket list.Recommendations
Remove the bucket from the previous candidate's bucket list and add the bucket to the new candidate's bucket list.