TempleGold

Summary

The TempleGoldStaking contract's reward distribution mechanism, specifically the _notifyReward() function, is susceptible to potential manipulation. This could lead to unfair reward distribution among stakers, particularly if the function is called frequently with varying amounts.

Vulnerability Details

The vulnerability lies in the _notifyReward() function:

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/TempleGoldStaking.sol#L515-L529

Key issues:

1. The reward rate can be changed frequently, potentially allowing for strategic timing of rewards.

2. The use of block.timestamp makes the function susceptible to minor manipulations by miners.

3. Precision loss may occur due to the conversion to uint216 for rewardRate.

4. Dust accumulation in nextRewardAmount could lead to undistributed rewards.

While the function is private, it's called by distributeRewards() and indirectly by notifyDistribution(), which is callable by the reward token contract. If these access points are compromised or manipulated, it could lead to unfair reward distribution.

Impact

The potential impacts of this vulnerability include:

• Uneven distribution of rewards among stakers with similar stake amounts and durations.

• Possibility for strategic actors to maximize their rewards at the expense of other stakers.

• Accumulation of undistributed rewards over time.

Tools Used

Manual review

Recommendations

1. Implement a minimum threshold for reward notifications to prevent frequent small updates that could be used for manipulation.

2. Consider using a time-weighted average for reward rates to smooth out short-term fluctuations and reduce the impact of individual notifications.

3. Add additional checks to ensure that rewardrate changes are within expected bounds.

4. Consider distributing accumulated dust (nextRewardAmount) periodically to ensure all rewards are distributed.

5. Use a more precise data type for rewardRate to minimize precision loss.