Submission Details
Severity:
Impossible for Rewards in staked contract to be distributed upon migration as `totalStakers` will be 0.
## Vulnerability Details
`TempleGoldStaking::distributeRewards` requires that `totalSupply == 0` and this will be overridden upon migration in case where it is the total number of stakers that has been migrated; that is upong calling `TempleGoldStaking::migrateWithdraw`. This would mean that the rewards is stucked in the staking contract.
## POC (include in TempleGoldStaking.t.sol)
```
function test_distributionFailsAfterMigration_tgldStaking() public {
vm.startPrank(executor);
staking.setMigrator(alice);
uint256 _rewardDuration = 16 weeks;
uint32 _vestingPeriod = uint32(_rewardDuration);
_setVestingFactor(templeGold);
_setVestingPeriod(_vestingPeriod);
_setRewardDuration(_rewardDuration);
// bob stakes
vm.startPrank(bob);
deal(address(templeToken), bob, 1000 ether, true);
_approve(address(templeToken), address(staking), type(uint).max);
staking.stake(100 ether);
// invalid access
vm.startPrank(unauthorizedUser);
vm.expectRevert(abi.encodeWithSelector(CommonEventsAndErrors.InvalidAccess.selector));
staking.migrateWithdraw(bob, 1);
uint256 aliceTempleBalance = templeToken.balanceOf(alice);
uint256 bobGoldBalance = templeGold.balanceOf(bob);
// distribute rewards to earn
skip(2 days);
// staking.distributeRewards();
uint256 bobEarned = staking.earned(bob, 1);
vm.startPrank(alice);
// invalid staker
vm.expectRevert(abi.encodeWithSelector(CommonEventsAndErrors.InvalidAddress.selector));
staking.migrateWithdraw(address(0), 1);
// zero stake
vm.expectRevert(abi.encodeWithSelector(CommonEventsAndErrors.ExpectedNonZero.selector));
staking.migrateWithdraw(unauthorizedUser, 1);
vm.expectEmit(address(staking));
emit Withdrawn(bob, alice, 1, 100 ether);
staking.migrateWithdraw(bob, 1);
assertEq(templeToken.balanceOf(alice), aliceTempleBalance + 100 ether);
vm.expectRevert(); // Distribution fails
staking.distributeRewards();
}
```
## Impact
Staked Reward locked in contract
## Tools Used
Manual
## Recommendations
Consider introducing a new variable to track the number of stakers and substitute for `if (totalSupply == 0) { revert NoStaker(); }`
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.