First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Holders can claim rewards without staking & staking just before first claim

honour

Description:
In Staking::claimRewards() first time claimers can claim rewards without staking if they deposit just before the first claim. This is because the staking period is calculated from the token idToCreationTimestamp rather than from the first deposit.

Proof of Concept:
Add test to Staking.t.sol

Holder claims rewards by staking just before the first claim

function test_CanClaimByStakingJustBefore() public {
//mints a soulmate token
_mintOneTokenForBothSoulmates();
vm.warp(block.timestamp + 2 weeks);
​
//2 weeks later
vm.startPrank(soulmate1);
airdropContract.claim(); //claims 14 loveTokens
uint256 balance = loveToken.balanceOf(soulmate1);
loveToken.approve(address(stakingContract), balance);
stakingContract.deposit(balance); //stakes 14 loveTokens
stakingContract.claimRewards(); // immediately claims 28 loveTokens
stakingContract.withdraw(balance); // withdraws 14 loveTokens
vm.stopPrank();
assertTrue(loveToken.balanceOf(soulmate1) == 42 ether);//now has 42 loveTokens
}

Tools Used:
Manual Review

Recommendation:
lastClaim should be checked and updated by Staking::deposit on first deposite

function deposit(uint256 amount) public {
if (loveToken.balanceOf(address(stakingVault)) == 0)
revert Staking__NoMoreRewards();
// No require needed because of overflow protection
userStakes[msg.sender] += amount;
if(lastClaim[msg.sender] == 0) lastClaim[msg.sender] = block.timestamp;
loveToken.transferFrom(msg.sender, address(this), amount);
​
emit Deposited(msg.sender, amount);
}

The check should be removed from Staking::claimRewards aswell

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.