stake.link

Summary

In case if user don't call after batch is processed, then he losses part of rewards and this rewards are distributed to other stakers.

Vulnerability Details

Let's consider the flow, when new lock is created on secondary pool. In this case it is batched and supply change is increased. But effective balance of user is not touched yet as lock is not created yet.

Then batch is processed and reSDLSupplyByChain is updated for the chain, which means that current chain will now get bigger part of SDLPoolCCIPControllerPrimary rewards(suppose that we have positive change). Also effective balance of ccip controller is updated inside SDLPoolPrimary, so it will get more rewards from reward pool.

All this means that once user has created new lock on l2 and batch is processed, then next reward distribution will already provides rewards for that lock. But effective balance of user on l2 is not increased yet. It will be only, when user will call executeQueuedOperations function and process new lock. Until then all user's rewards will be distributed to other stakers.

Impact

User loses part of rewards

Tools Used

VsCode

Recommendations

Think about a way to automate new locks minting and lock updates processing.