Submission Details
Severity:
`Distribution`._withdraw function can lose user reward
Summary
When a user withdraw token from a pool, the Distribution._withdraw function can lose user reward if a user make 2 withdrawals in a row without claiming his pending reward in the meantime.
Vulnerability Details
at line 273 of the file Distribution.sol
userData.pendingRewards = pendingRewards_;
Impact
High impact because previous pending reward will be overwritten.
Tools Used
Reading the code
Recommendations
- userData.pendingRewards = pendingRewards_;
+ userData.pendingRewards += pendingRewards_;
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.