First Flight #13: Baba Marta

Summary

The collectReward function in the MartenitsaMarketplace.sol contract enables users to claim rewards based on their token ownership. However, a vulnerability exists in the current implementation, allowing users to potentially receive more rewards than intended by claiming them incrementally. This vulnerability stems from the incorrect handling of previously claimed rewards, leading to an inflation of rewards and imbalance in the ecosystem.

Vulnerability Details

The vulnerability arises due to the flawed calculation of rewards in the collectReward function. Users are entitled to one reward token for every three tokens they own. However, the function fails to accurately track previously claimed rewards, resulting in users potentially receiving excessive rewards when claiming them incrementally.

For example, if a user owns 12 tokens and claims rewards incrementally, they should receive 4 reward tokens in total. However, due to the oversight, they may receive 6 reward tokens instead, resulting in an unintended increase in the reward distribution.

A proof of concept demonstrating this vulnerability is available in the following gist: Proof of Concept Gist. It should be added to the MartenitsaMArketplace.t.sol file.

Impact

This vulnerability enables users to exploit the reward system, potentially leading to an inflation of rewards and disrupting the ecosystem's balance. It may result in an increased circulating supply of reward tokens, affecting their value and utility within the platform. Moreover, it undermines the fairness and integrity of the reward distribution mechanism.

Tools Used

manual code review.

Recommendations

To mitigate this vulnerability and ensure the accurate distribution of rewards, it is imperative to implement proper tracking of previously claimed rewards. Adjust the collectReward function as follows:

With this fix, the collectReward function accurately tracks previously claimed rewards and ensures users receive rewards based on their total token ownership. This adjustment promotes fairness and consistency in the reward distribution process.