kaancaglan - Inaccurate Exchange Rate in `calculateAccruedVvvAmount` Function

[sherlock-admin4]

kaancaglan

medium

Inaccurate Exchange Rate in calculateAccruedVvvAmount Function

Summary

The Ethereum staking contract incorporates a function, calculateAccruedVvvAmount, designed to compute the total amount of $VVV tokens accrued for a given stake based on the amount of ETH staked, the staking duration, and an exchange rate between ETH and $VVV. A critical issue with this functionality is identified in the use of a constant, static exchange rate of 1:1 (ETH:VVV) defined in the ethToVvvExchangeRate function, which does not reflect market realities and could lead to significant discrepancies in rewards calculations.

Vulnerability Detail

The ethToVvvExchangeRate function returns a hardcoded value of 1, suggesting a 1:1 exchange rate between ETH and $VVV. This approach fails to account for the volatile nature of cryptocurrency values, where the exchange rate between two currencies can fluctuate widely within short periods. Relying on a static exchange rate for calculating staking rewards can result in inaccurate accrual of $VVV tokens, potentially disadvantaging users or the platform depending on market movements.

Impact

The primary impact of this issue is twofold:

• Misrepresentation of Staking Rewards: Users might receive more or less $VVV than they are entitled to based on the current market value of ETH, leading to dissatisfaction, loss of trust, and potential financial disparities.

• Economic Imbalances: A static exchange rate could create scenarios where the platform either overpays or underpays rewards, impacting its economic sustainability. Overpayment may lead to inflationary pressures on $VVV, while underpayment could discourage participation in the staking program.

Code Snippet

///@notice Returns the exchange rate of ETH to $VVV for staking reward accrual
function ethToVvvExchangeRate() public pure returns (uint256) {
    return 1;
}

Link

Tool used

Manual Review

Recommendation

To address this issue and align the staking rewards calculation with real-world dynamics, the following recommendation is proposed:

• Dynamic Exchange Rate Integration: Replace the static exchange rate with a dynamic mechanism that fetches real-time exchange rates from a reliable cryptocurrency price oracle or liquidity pool. This ensures that the calculation of $VVV rewards is based on current market conditions.

[sherlock-admin3]

1 comment(s) were left on this issue during the judging contest.

itsabinashb commented:

Invalid because the exchange rate is correct.