sherlock-audit / 2023-05-perennial-judging

12 stars 9 forks source link

rvierdiiev - BalancedVault doesn't have ability to claim and distribute rewards among holders #204

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

rvierdiiev

high

BalancedVault doesn't have ability to claim and distribute rewards among holders

Summary

BalancedVault doesn't have ability to claim and distribute rewards among holders.

Vulnerability Detail

BalancedVault uses deposited by users funds in order to open position in oposite markets. For example it can use eth long/short products.

Each product can have rewards programs inside Incentivizer contract. This rewards are earned by traders of a product and later they can claim them. Trader can claim rewards for himself only, it's not possible to do that for someone else.

The problem is that BalancedVault contract doesn't have ability to claim that rewards, however it will be earning them a lot, because of big amount of positions. As result this rewards will never be received by vault and distributed by stakers.

Impact

Rewards can't be claimed.

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/incentivizer/Incentivizer.sol#L138-L143

Tool used

Manual Review

Recommendation

Add ability to claim this rewards in order to swap them to the collateral asset and distribute among vault users.

Duplicate of #43