TempleGold

Summary

After consulting with sponsors, we conclude that there is an intention to sometimes additionally fund the staking contract with funds (reward token) recovered from - e.g. the DaiGoldAuction contract. Staking contract can not receive additional funds - due to its design. Therefore, reward token funds - intended for distribution - will be lost and stuck on the contract.

Vulnerability Details

The only way the staking contract can properly receive reward token is by distribution from TempleGold contract. Intent to fund it additionally is not possible and notifyDistribution(uint256) - function which handles reward token distribution amont - is restricted.

Impact

Staking contract can not receive additional rewards token - therefore funds send to it will be lost.

Tools Used

Manual review

Recommendations

Add restricted function that allows someone to additionally fund the staking contract with reward tokens and account for it properly in the contract.