MorpheusAI

Summary

An admin can update the core parameters of a specific pool via the Distribution:editPool(). However, the function lacks a sanity check on the payoutStart parameter, leading to incorrect or unfair reward distributions to pool stakers.

Vulnerability Details

The snippet below presents the editPool(). As you can see, the function does not have a sanity check on the pool_.payoutStart parameter. Therefore, the pool_.payoutStart parameter can be set to an arbitrary timestamp, including the past timestamp.

Suppose the past timestamp is set by mistake. The pool will distribute rewards to stakers by accounting for past staking positions, which can lead to incorrect or unfair reward distribution issues for some stakers.

To elaborate, for instance, if some stakers had unstaked their staking positions before the pool in question was updated, they would lose the rewards even if the reward distribution also accounts for the period of time they had ever staked in the pool. In other words, the pool should not distribute rewards to past staking positions for fair distributions.

• https://github.com/Cyfrin/2024-01-Morpheus/blob/07c900d22073911afa23b7fa69a4249ab5b713c8/contracts/Distribution.sol#L82-L96

Impact

Distributing rewards by accounting for past staking positions can lead to incorrect or unfair reward distribution issues for some stakers.

For instance, if some stakers had unstaked their staking positions before the pool was updated, they would lose the rewards even if the reward distribution also accounts for the period of time they had ever staked in the pool. In other words, the pool should not distribute rewards to past staking positions for fair distributions.

Tools Used

Manual Review

Recommendations

Add a sanity check on the pool_.payoutStart parameter, like the below snippet. The sanity check ensures that the pool cannot distribute rewards to past staking positions for fair reward distributions.