The Staking::claimRewards
function incorrectly uses the Soulmate creation timestamp (Soulmate::idToCreationTimestamp
) as the basis for calculating rewards for first-time claims. This approach does not accurately reflect the user's staking period and result in incorrect reward calculations.
The soulmate1 claims and deposits their loveToken at block.timestamp + 14 days
. At the same time he/she calls the claimRewards
rewards function. The solmate1 should receive 0 token because 0 days are passed from the deposit time (the staking reward is fixed at 1 token/week). But the solmate1 receives 28 loveToken, because the basis for calculating rewards for first-time claims is incorrectly done on the Soulmate::idToCreationTimestamp
and not on deposit Token time.
Manual review
Modify the claimRewards
function to use the deposit timestamp as the starting point for calculating rewards. Implement a mechanism to track the first deposit timestamp for each user and ensure that the lastClaim mapping is updated accordingly. Consider adding checks to prevent users from claiming rewards before making a deposit.
High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.