MorpheusAI

Summary

User will lose part, or even all reward if reward is not claimed for a long time due to current formula

Vulnerability Details

Function _calculateFullPeriodReward is used to calculate reward for full period intervals as below:

function _calculateFullPeriodReward(
    uint128 payoutStart_,
    uint128 startTime_,
    uint128 endTime_,
    uint128 interval_,
    uint256 initialAmount_,
    uint256 decreaseAmount_
) private pure returns (uint256) {
    // START calculate initial reward when period start
    uint256 timePassedBefore_ = startTime_ - payoutStart_;
    uint256 intervalsPassedBefore_ = _divideCeil(timePassedBefore_, interval_);

    uint256 decreaseRewardAmount_ = intervalsPassedBefore_ * decreaseAmount_;

    if (decreaseRewardAmount_ >= initialAmount_) {
        return 0;
    }

    uint256 initialReward_ = initialAmount_ - decreaseRewardAmount_;
    // END

    // Intervals passed
    uint256 ip_ = ((endTime_ - payoutStart_ - intervalsPassedBefore_ * interval_) / interval_);
    if (ip_ == 0) {
        return 0;
    }

    return initialReward_ * ip_ - (decreaseAmount_ * (ip_ * (ip_ - 1))) / 2;
}

At first, it will check if reward is still claimable at start time or not:

    if (decreaseRewardAmount_ >= initialAmount_) {
        return 0;
    }

And the reward is calculated based on that data:

    uint256 ip_ = ((endTime_ - payoutStart_ - intervalsPassedBefore_ * interval_) / interval_);
    if (ip_ == 0) {
        return 0;
    }

    return initialReward_ * ip_ - (decreaseAmount_ * (ip_ * (ip_ - 1))) / 2;

Problem is it only check if reward is claimable at start time, but not when intervals passed.
Consider scenario: we have M full period passed, and at the start , condition decreaseRewardAmount_ >= initialAmount_ is true. But after N full period (N < M), initialReward_ < N * decreaseAmount_, and till the end, reward is decreased, and it can be negative, which lead to loss of reward for user

Impact

User can loss reward because of the way formula is calculated

Tools Used

Manual review

Recommendations

When calculating full reward, make sure that in each period, number of reward is still positive.