Summary

Vulnerability Details

The system calculates rewards based on changes in the pool's rate since the user's last activity without accounting for the actual duration the funds were staked. This mechanism is illustrated in the _getCurrentUserReward function which bases reward calculation solely on the rate change and the amount deposited without factoring in the time those funds were actively staked.

The contract's withdrawal logic permits users to withdraw their stake before the pool's payout start.

Impact

This flaw allows malicious actors to game the system by accumulating rewards through repeated deposits and withdrawals, without the need for genuine or sustained participation in the staking protocol

Tools Used

Manual Review

Recommendations

Overhaul the reward calculation mechanism to include the duration of staking as a factor.