MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Instant Reward Accumulation and Premature Withdrawals Enable Reward Manipulation

ro1sharkm

Summary

This flaw arises from the ability to stake funds and withdrawing these funds even before the pool's designated payout start while accruing the rewards from the deposit. This mechanism can be exploited repeatedly to accumulate rewards disproportionately without genuine participation in the staking protocol.

Vulnerability Details

The distribution contract calculates new rewards based on the pool's rate change since the user's last interaction disregarding the duration the funds were actually staked.

function _getCurrentUserReward(uint256 currentPoolRate_, UserData memory userData_) private pure returns (uint256) {
uint256 newRewards_ = ((currentPoolRate_ - userData_.rate) * userData_.deposited) / PRECISION;
return userData_.pendingRewards + newRewards_;
}

A malicious user stakes some amount and stake function culculates pending rewards and updates userData and PoolData.The user proceeds to call the withdraw function to withdraw the previously staked amount.
The withdraw function has a require statement:

require(
block.timestamp < pool.payoutStart ||
(block.timestamp > pool.payoutStart + pool.withdrawLockPeriod &&
block.timestamp > userData.lastStake + pool.withdrawLockPeriodAfterStake),
"DS: pool withdraw is locked"
);

The first condition allows a user to proceed with withdraw even before pool.payoutStart which can be anytime after staking.The _getCurrentUserReward() returns the user rewards based on rate change (currentPoolRate_ - userData_.rate) and the rewards are stored in userData to be claimed later.

The user can repeat this process, accruing rewards without genuine long-term staking

Impact

Malicious actors can accumulate rewards without genuine participation depleting the reward pool rapidly and disadvantaging honest participants.

Tools Used

Manual Review

Recommendations

Modify the reward calculation mechanism to consider the duration of staking

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.