MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`Distribution::_validatePool` allows pools with zero `rewardDecrease`

WangSecurity

Summary

Distribution::_validatePool allows to validate pool with zero rewardDecrease.

Vulnerability Details

The function only checks that decreaseInterval is bigger than zero. I understand that pools are only created by the Owner and won't complain if this issue is invalidated, but that check still doesn't prove that the Pool has a valid reward decrease. Therefore, the protocol will lose funds, due to more rewards being paid out in a pool.

Function:

function _validatePool(Pool calldata pool_) private pure {
require(pool_.decreaseInterval > 0, "DS: invalid decrease interval");
}

Impact

As said above, users of that particular pool will get more rewards than they should, therefore, protocol will lose those funds.

Tools Used

Manual Review

Recommendations

Implement the check for rewardDecrease:

function _validatePool(Pool calldata pool_) private pure {
+ require(pool_.rewardDecrease > 0, "DS: invalid decrease reward");
require(pool_.decreaseInterval > 0, "DS: invalid decrease interval");
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.