Staking rewards can be gamed
Summary
Any one can deposit, claim rewards and then withdraw tokens.
Vunerability Details
There are no checks to ensure that the depositor deposits for a specific duration of time before claimable rewards accrue to him. As such, no one is prevented from depositing reward tokens, claiming rewards, and withdrawing the staked tokens. As such, there is no incentive for users to keep their tokens staked.
This issue can be exacerbated if there are flash loans available for the reward tokens.
Impact
High
Tools Used
Manual Review
Recommendations
Maintain checkpoints for RTK deposit and withdrawals. Use the seconds passed since deposit in the rewards calculation. Disallow depositing and withdrawing in the same block.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.