First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`claimRewards` can be manipulated, user can get extra rewards

0xtheblackpanther

Summary

The Staking contract contains a vulnerability related to the claim rewards function, where user rewards are calculated based on the total staked amount at the time of claim. This vulnerability allows users to potentially exploit the system by depositing additional tokens just before claiming, resulting in inflated rewards.

Vulnerability Details

In the staking contract's claim function, the rewards calculation is performed using the formula:

uint256 amountToClaim = userStakes[msg.sender] * timeInWeeksSinceLastClaim;

However, the userStakes[msg.sender] value can be updated through the deposit function, allowing users to manipulate their rewards by depositing additional tokens just before claiming. So if claim period is reached, he can deposit more tokens and get extra rewards in claiming.

Impact

This vulnerability has the potential to result in disproportionate rewards for users who deposit additional tokens right before claiming. Such manipulation could lead to an imbalance in the reward distribution and impact the fairness of the staking system.

POC

  • Copy below test and run it via ``
    Test:

function testManipulateClaimRewards() public {
uint256 balancePerSoulmates = 5 ether;
uint256 weekOfStaking = 5;
_depositTokenToStake(balancePerSoulmates);
​
vm.warp(block.timestamp + weekOfStaking * 1 weeks + 1 seconds);
​
// lets add more tokens before claiming rewards ;)
_depositTokenToStakeForTest(balancePerSoulmates);
vm.prank(soulmate1);
stakingContract.claimRewards();
​
assertTrue(loveToken.balanceOf(soulmate1) == weekOfStaking * balancePerSoulmates + balancePerSoulmates);
// initial rewards was 25000000000000000000 but when user add more before claiming and claim period is passed
// the new reward will be 30000000000000000000
console2.log(loveToken.balanceOf(soulmate1));
}

Result:

Logs:
30000000000000000000
​
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 11.32ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Recommendations

Implement Snapshot Mechanism:

  • Introduce a snapshot mechanism to capture the user's staked amount at the beginning of each staking period. Use this snapshot value for reward calculations, ensuring consistency and preventing manipulation.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.