stake.link

Summary

User can lose his boosted rewards in case rewards distributions are delayed or not distributed before he unlock

Vulnerability Details

Check SDLPoolPrimary.InitiateUnlock()
There is a possibility that a staker lose total of his boosted amount even if his locking duration have
totaly elapsed before he initiated an unlock.
this is possible because boosted reward are distributed periodically
therefore if boosted rewards have not been distributed during the lock period or delayed and user initiate an unlock he lose all his boosted rewards

Consider this scenario:

• Alice stake and lock her sdl for 6 months ( this is just an example, in reality it can vary).

• Alice accumulate some boosted rewards

• Then she changes her mind after 2 weeks during which rewrads have not been distributed or have been delayed

• Alice initiate an unlock => her boosted rewards gets set to 0 as seen in this line

• Alice lost her boosted rewards she accumulated

Impact

User might lose boosted rewards

Tools Used

Manual review,
VsCode

Recommendations

One way i can think of to mitigate this is to track user boosted rewards in a separate variable( mapping ...) , and use the mapping to send rewrads after