MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

editing pool with different payoutStart can result in more rewards distribution than intended

VaRuN

Summary

If a different payout start time is set while editing the pool it can cause more rewards being distributed.

Vulnerability Details

Following is editPool function

function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
​
PoolData storage poolData = poolsData[poolId_];
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
// Update pool data
poolData.rate = currentPoolRate_;
poolData.lastUpdate = uint128(block.timestamp);
​
pools[poolId_] = pool_;
​
emit PoolEdited(poolId_, pool_);
}

Now if a user had deposited in the pool before being editing then it can cause some extra rewards being transferred
for example if the value of payout start is set greater than block.timestamp then when the calculation of rewards will be done then the value of poolData.lastUpdate = uint128(block.timestamp); would be less than payout start time therefore it would appear as if the user had deposited before the starting the 1st interval therefore he would be eligible for the rewards for that full interval.But originally before editing the pool if the user had deposited after the start of the first interval he wouldn't be eligible for the rewards of that whole round. For example if for the first interval total rewards are equal to 10 and the user deposited tokens after payout start time then he wouldn't be eligible for the rewards of that whole round but if after editing if the payout start id set after the block.timestamp now the user would be eligible for the rewards of that whole round.
Now if payout start is set at a value less than previous payout then it can cause more intervals to pass through which causes loss of rewards for the users because after each interval the rewards decrease.
This is a isssue because owner might want to increase the payout start time if there are no deposits or maybe due to some other reasons but if there are previous deposits it might lead to unintended behaviour.
All the rewards distribution can be seen in the LinearDistributionIntervalDecrease.sol

Impact

It can cause loss of rewards for the users as well as can cause a user to earn more rewrds.

Tools Used

manual Review

Recommendations

add the following check

function editPool(uint256 poolId_, Pool calldata pool_) external onlyOwner poolExists(poolId_) {
_validatePool(pool_);
require(pools[poolId_].isPublic == pool_.isPublic, "DS: invalid pool type");
@==> require(pools[poolId_].payoutStart == pool_.payoutStart, "DS: invalid pool type");
​
​
PoolData storage poolData = poolsData[poolId_];
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
// Update pool data
poolData.rate = currentPoolRate_;
poolData.lastUpdate = uint128(block.timestamp);
​
pools[poolId_] = pool_;
​
emit PoolEdited(poolId_, pool_);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`editPool` function doesn't do the payoutStart check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.