The Standard

Summary:

The protocol permits users to stake TST and/or EUROs in the Liquidation Pool, accruing rewards from borrowing fees and vault liquidations. These rewards are claimable by stakers at their discretion. However, an issue arises when a token, once accepted and used in liquidations, is subsequently removed from the protocol. This removal prevents users from claiming their pending rewards in the removed token.

Vulnerability Details:

The claimRewards function enables users to claim their liquidation rewards, which are available for claiming anytime. This function relies on the getAcceptedTokens method to identify tokens eligible for reward distribution.

The issue arises when the protocol’s list of accepted tokens is modified, particularly when tokens are removed. Any rewards pending in the removed token becomes unclaimable, as the claimRewards function ceases to recognize them as part of the rewardable assets.

Impact

Users will be unable to claim rewards that they have earned from liquidations involving tokens that have been removed from the accepted list.

Tools Used:

Manual analysis

Recommendation:

Modify the reward claiming process to include both current and previously accepted tokens. This adjustment will ensure that users can always claim their rewards, irrespective of any changes in the accepted tokens list.