MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Enhancing `Distribution::claim` for Transaction Fee Estimation

m4k2

Summary

The current claim function in the Distribution contract lacks a mechanism to estimate transaction fees accurately, potentially leading to failures. Users can send arbitrary values, risking insufficient gas and transaction failures. Utilizing the estimateFees() function, detailed here, is recommended to ensure precise fee calculation for successful transactions.

Vulnerability Details

function claim(uint256 poolId_, address user_) external payable poolExists(poolId_) {
Pool storage pool = pools[poolId_];
PoolData storage poolData = poolsData[poolId_];
UserData storage userData = usersData[user_][poolId_];
​
require(block.timestamp > pool.payoutStart + pool.claimLockPeriod, "DS: pool claim is locked");
​
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
uint256 pendingRewards_ = _getCurrentUserReward(currentPoolRate_, userData);
require(pendingRewards_ > 0, "DS: nothing to claim");
​
// Update pool data
poolData.lastUpdate = uint128(block.timestamp);
poolData.rate = currentPoolRate_;
​
// Update user data
userData.rate = currentPoolRate_;
userData.pendingRewards = 0;
​
// Transfer rewards
L1Sender(l1Sender).sendMintMessage{value: msg.value}(user_, pendingRewards_, _msgSender());
​
emit UserClaimed(poolId_, user_, pendingRewards_);
}

Recommendations

Integrate the estimateFees() endpoint into the claim function to empower users with accurate fee calculations, reducing the risk of transaction failures.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

LayerZero Integration: `sendMintMessage` doesn't verify the `msg.value` sent by the user facilitating failed transactions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.