TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Griefing attack: attacker can make `rewardPerTokenStored` value unchanged by continuously spamming getReward/stake/withdraw function

zukanopro

Summary

By continuously spamming getReward/stake/withdraw function, attacker will make rewardPerTokenStoredvariable unchanged while the time keep increasing, lead to non reward will be claimable by all staker.

Vulnerability Details

When updateRewardmodifier is called, it will update rewardPerTokenStoredand lastUpdateTime:

modifier updateReward(address _account, uint256 _index) {
{
// stack too deep
rewardData.rewardPerTokenStored = uint216(_rewardPerToken()); // <--
rewardData.lastUpdateTime = uint40(_lastTimeRewardApplicable(rewardData.periodFinish)); // <--
. . . . . .
}
}

_rewardPerToken()function:

function _rewardPerToken() internal view returns (uint256) {
if (totalSupply == 0) {
return rewardData.rewardPerTokenStored;
}
​
return
rewardData.rewardPerTokenStored +
(((_lastTimeRewardApplicable(rewardData.periodFinish) -
rewardData.lastUpdateTime) *
rewardData.rewardRate * 1e18)
/ totalSupply);
}
​

lastTimeRewardApplicable()function:

function _lastTimeRewardApplicable(uint256 _finishTime) internal view returns (uint256) {
if (_finishTime < block.timestamp) {
return _finishTime;
}
return block.timestamp;
}

It can be seen that in _rewardPerToken()function, if (((_lastTimeRewardApplicable(rewardData.periodFinish) - ````rewardData.lastUpdateTime) * ````rewardData.rewardRate * 1e18) ````/ totalSupply);equal to 0, rewardPerTokenStoredwill be unchanged, but lastUpdateTimevalue is still updated. When totalSupplyis big enough, and attacker continuously call functions that have updateRewardmodifier (getReward/stake/withdraw), reward wont be updated.

Impact

Reward cant be claimed when totalSupplyis big enough because rewardPerTokenStored unchanged while time is up.

Tools Used

Manual review

Recommendations

Update lastUpdateTimeonly when rewardPerTokenStoredis increased

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.