First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

claimRewards() calculation is wrong

Nocturnus

Summary

The claimRewards() function currently calculates the amountToClaim based on the idToCreationTimestamp.

Vulnerability Details

But it does not account for the actual duration of tokens held within the contract.

Impact

This approach allows for potential manipulation by malicious actors who could claim excessive rewards.

PoC:

function test_claimRewardsClockStartsFromIdToCreationTimestamp() public {
uint256 weekOfStaking = 5;
_mintOneTokenForBothSoulmates();
// soulmate1 deposits his balance
vm.prank(soulmate1);
stakingContract.deposit(loveToken.balanceOf(soulmate1));
vm.warp(block.timestamp + weekOfStaking * 1 weeks + 1 seconds);
// soulmate2 deposits his balance after 5 weeks
vm.prank(soulmate2);
stakingContract.deposit(loveToken.balanceOf(soulmate2));
// soulmate1 withdraws his balance
vm.prank(soulmate1);
stakingContract.claimRewards();
// soulmate2 withdraws his balance
vm.prank(soulmate2);
stakingContract.claimRewards();
​
//soulmate1 and soulmate2 balances are equalt even though their deposit dates are different
assertEq(loveToken.balanceOf(soulmate1), loveToken.balanceOf(soulmate2));
}

Tools Used

Manual review

Recommendations

To address this vulnerability, it is recommended to implement a time-based calculation for amountToClaim that begins when a user deposits tokens and concludes when they withdraw. This ensures that rewards are calculated accurately based on the actual time period during which tokens are staked.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.