The Standard

Summary

Since fees are distributed to pendingStakes also, a malicious user can add much more collateral to the system and earn much more fee.

Vulnerability Details

Let's say that the manager calls the LiquidationPool::distributeFees function once a week. As a result, standard users have to wait a week to earn their fee. However, a malicious user can frontrun this function and earn a significantly larger fee through this calculation. This results in standard users earning much less fee, making the system unfair. The system will lose its reputation, which will result in a decrease for its holders.

Impact

A malicious user can earn much more fees by frontrunning the distributeFees function and reducing the fee of standard users.

Tools Used

Manual Review

Recommendations

Cancel giving fees to pendingStakes or add timestamp check to prevent frontrunnig distributeFees function.