missing timely update staking rewards for deposit()/withdraw()
Summary
missing timely update staking rewards for deposit()/withdraw()
Vulnerability Details
Alice deposits one LoveToken into staking smart contract.
After a long time, Alice deposits 1000 LoveToken into staking smart contract.
When Alice tries to claim staking rewards, smart contract will calculate rewards by 1000 multiply time. So Alice can claim more rewards than expected.
Impact
Alice can claim more rewards.
Tools Used
Manual
Recommendations
When users deposit/withdraw with staking, need to update rewards timely.
Lead Judging Commences
finding-claimRewards-multi-deposits-time
High severity, this allows users to claim additional rewards without committing to intended weekly staking period via multi-deposit/deposit right before claiming rewards.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.