First Flight #9: Soulmate

Summary

The Staking contract for LoveToken allows users to stake tokens to earn rewards over time, calculated on a weekly basis. This mechanism is designed to reward long-term holders. However, a vulnerability exists where an attacker can exploit the contract's reward calculation logic using a flash loan, enabling them to claim disproportionately high rewards.

Vulnerability Details

The issue lies within the claimRewards function, which calculates the reward based on the total amount of tokens staked and the time elapsed since the last claim. The contract does not account for the duration each individual token was staked, allowing the calculation of rewards based on the current balance at the time of claim. This oversight makes it possible for an attacker to:

1. Stake a small amount of tokens.

2. Wait for a week to become eligible for rewards.

3. Obtain a large amount of tokens via a flash loan just before claiming rewards.

4. Deposit the flash-loaned tokens, significantly increasing their staked balance.

5. Call claimRewards to claim a large number of rewards based on the artificially inflated staked amount.

6. Withdraw the flash-loaned tokens and return them to the flash loan provider, keeping the excess rewards.

Impact

This vulnerability can lead to the inflation of the reward token's supply, devaluing the token and undermining the integrity of the staking mechanism. It allows attackers to drain the staking pool's rewards with minimal initial investment, potentially causing significant financial loss to the protocol and its legitimate users.

Tools Used

• Manual code review

Recommendations

To mitigate this vulnerability and prevent exploitation, consider implementing the following changes:

1. Snapshot Mechanism: Introduce a mechanism to take snapshots of user balances at each block. Calculate rewards based on the amount of time each token was actually staked, rather than the balance at the time of claiming.

2. Lock-up Period: Implement a lock-up period for newly deposited tokens, during which these tokens do not earn rewards. This period should be at least as long as the reward calculation period (e.g., one week).