TempleGold

Summary

The _notifyReward function in the TempleGoldStaking contract incorrectly extends the reward period every time new rewards are added. Due to frequent calls to distributeRewards, this causes continuous period extension and progressive dilution of the reward rate, severely impacting the staking mechanism's effectiveness.

Vulnerability Details

In the _notifyReward function:

The function always extends periodFinish, and for ongoing periods, it recalculates the reward rate based on the extended duration. With distributeRewards callable every 10 seconds to 1 minute (as per test configurations), this leads to:

1. Continuous extension of the reward period.

2. Constant recalculation and dilution of the reward rate.

3. Discrepancy between intended and actual reward distribution timeframes.

Note: The current implementation also blocks calls to setVestingPeriod and setRewardDuration functions due to their checks if (rewardData.periodFinish >= block.timestamp) { revert InvalidOperation(); }. As the period finish time is constantly extended, these critical configuration functions become unusable, further compromising the contract's adaptability and management.

Impact

Severe Reward Rate Dilution: As the period is continuously extended and the reward rate recalculated, the effective reward rate for stakers dramatically decreases over time. This results in stakers receiving significantly fewer rewards than intended, potentially approaching zero as the period extends indefinitely.

Recommendation

Modify the _notifyReward function to maintain fixed-duration reward periods: