User may not receive rewards in liquidation pool
Summary
when a user deletes a position while having a pending stake simultaneously, his new position won't get rewards after consolidating the pending stake.
Vulnerability Details
if the user withdraws all staked tokens, decreasePosition removes the user from the holder's list, then if the user has a pending stake, after consolidating pending stakes, the pending stake is added to the position but he's not in the holder's list so won't get rewards for the position through distributeFees and distributeAssets.
Impact
the user gets removed from the distribution fees and rewards list
Tools Used
Manual Review
Recommendations
use addUniqueHolder function in consolidatePendingStake function
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.