MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Users are disincentivized of submitting large stakes into pools

matejdb

Summary

Pools with a small amount of stakers are disincentivizing those users of staking large amounts of stETH into the pools because of the way the rewards mechanics work.

Vulnerability Details

Because of the mechanics of the rewards creation, no matter how much stakes are in the pool - the same amount of rewards will be distributed. If there are small amounts of stakes in the pool nobody will be incentivized to stake more given they are satisfied with the reward they generated.

Consider my POC. No matter how much a lone staker puts in the pool he will receive the same amount of rewards. Why would he put 10 stETH if he can put 1 stETH.
If there are 5 of them why would they chase rewards with putting A LOT of stETH into the pool if they can split it with a minimum stake in the pool.

Impact

Users are not incentivized to put large amount of stETH into smaller pools if they can already reap sufficient enough rewards with small stakes.

Beside this, I do not believe it is fair to distribute the same rewards in pools with a big difference in the deposits provided.

POC

Put this in withdraw of Distribution.test.ts.

it('should overwrite userData.pendingRewards if user withdraws', async () => {
​
await distribution.stake(poolId, wei(0.2)); // no matter what amount you put here, the same amount of REWARDS will always be produced.
​
await setNextTime(oneDay + oneDay);
await distribution.withdraw(poolId, wei(0.1));
​
let userData = await distribution.usersData(ownerAddress, poolId);
console.log("pending rewards")
console.log(userData.pendingRewards)
console.log("deposited")
console.log(userData.deposited)
​
await setNextTime(oneDay + oneDay * 3);
await distribution.withdraw(poolId, wei(0.1));
​
userData = await distribution.usersData(ownerAddress, poolId);
console.log("pending rewards")
console.log(userData.pendingRewards)
console.log("deposited")
console.log(userData.deposited)
​
});

This POC serves to show that no matter how much a lone user has staked in the pool, he will always generate the same amount of rewards in the same time period.

Tools Used

Manual review

Recommendations

Reconsider the pool rewards distribution mechanics in order to incentivize stakes into pools.
Maybe distribute more rewards to pools that have more stakes in them.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.