Summary

All reward MOR tokens will be lost for the users using the account abstraction wallet.

Vulnerability Details

The "Distribution.stake" function when user depositing stETH creates a new or updates an old position, and uses the "msg.sender" address to identify the user's position in the pool:

Then the user wants to claim rewards and he calls in Ethereum chain "Distribution.claim" function, that also calls "L1Sender(l1Sender).sendMintMessage()" function, that construct the payload as follow:

Here we can see the payload passes "user_" as receiving address on other chain assuming that user have same address on Arbitrum chain, which is not the case if user is using the account abstraction wallet. On destination chain same person will not be the owner of that address, and hence tokens are permanently lost.

Impact

If someone using account abstraction wallet to claim rewards, MOR tokens will be minted to wrong address and lost permanently.

Tools Used

Manual review.

Recommendations

Give the user to pass in the address the tokens should be minted to on the Arbitrum chain. Also add check that "msg.sender == user_" to awoid stealing rewards.