stake.link

Summary

The distributeRewards function in the SDLPoolCCIPControllerPrimary is susceptible to a division by zero error when totalRESDL is zero. This situation arises if there are no locks on any secondary chains, resulting in a potential runtime error during reward distribution.

Vulnerability Details

The specific vulnerability lies in the following code snippet:

If totalRESDL is zero, the division operation may result in a runtime error, leading to transaction revert.

Impact

The rewards distribution function is a critical component of SDLPoolCCIPControllerPrimary. If a division by zero occurs, the potential error could significantly impact the correctness and security of the entire system, affecting the expected behavior of the reward distribution mechanism. This vulnerability may lead to a runtime error, specifically resulting from a division by zero, posing a substantial risk to the robust functioning of the contract and its associated interactions.

Tools Used

Manual review.

Recommendations

It is recommended to implement a check to ensure that totalRESDL is greater than zero before performing the division operation. This prevents division by zero errors and provides a more robust handling of scenarios where there are no locks on any secondary chains.

Here is an example of the recommended code modification:

This modification ensures a safer distribution mechanism by preventing division by zero and provides better handling of edge cases.