0xlucky - In function topUp() staking.setRewardsDuration() allows setting near zero or enormous `rewardsDuration`, which breaks reward logic

[sherlock-admin]

0xlucky

medium

In function topUp() staking.setRewardsDuration() allows setting near zero or enormous rewardsDuration, which breaks reward logic

Summary

setrewardsduration function used in StakingRewardManager contract will impact in notify reward functoin by setting it 0 or very big value

Vulnerability Detail

Impact

notifyRewardAmount will be inoperable if rewardsDuration bet set to zero. If will cease to produce meaningful results if rewardsDuration be too small or too big

Code Snippet

https://github.com/sherlock-audit/2024-01-telcoin/blob/main/telcoin-audit/contracts/telx/core/StakingRewardsManager.sol#L264C13-L264C39

The setter do not control the value, allowing zero/near zero/enormous duration:

https://github.com/sherlock-audit/2024-01-telcoin/blob/main/telcoin-audit/contracts/telx/core/StakingRewards.sol#L260C4-L267C6

Division by the duration is used in notifyRewardAmount:

https://github.com/sherlock-audit/2024-01-telcoin/blob/main/telcoin-audit/contracts/telx/core/StakingRewards.sol#L260C4-L267C6

Tool used

Manual Review

Recommendation

Check for min and max range in the rewardsDuration setter, as too small or too big rewardsDuration breaks the logic

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid because { This is admin function and we expect the admin to put the correct and expected values}

[nevillehuang]

Invalid, out of scope, and additionally setRewardsDuration is an admin permissioned function, admins are trusted entities trusted to set appropriate rewards duration.