Submission Details
Severity:
`unclaimedRewards` not updated if users stake multiple times in the same epoch
Details
No matter how many times a user stakes in a particular epoch, his unclaimedRewards are updated only once and all subsequent stakes are not inclusive. This breaks a core invariant as all stakes are meant to be accumulated to a users unclaimedRewards. However, this update is done only once.
Tool Used
Manual Review
POC
function testUnstakeImmediately() external {
vm.prank(minter);
fjordStaking.addReward(1 ether);
vm.prank(bob);
fjordStaking.stake(1 ether); // By defaulting no one gets rewarded in the first epoch so unclaimedRewards is 0
(
uint256 totalStaked,
uint256 unclaimedRewards,
uint16 unredeemedEpoch,
uint16 lastClaimedEpoch
) = fjordStaking.userData(address(bob));
console.log("unclaimedRewards", unclaimedRewards);
console.log("unredeemedEpoch", unredeemedEpoch);
_addRewardAndEpochRollover(1 ether, 2); // roll over 2 epochs and adding 1 ether rewards in each epoch
assertEq(fjordStaking.currentEpoch(), 3); // Now at epoch 3
vm.prank(bob); //
fjordStaking.stake(1 ether); // Bob stakes 1 ether and is now entitled to the total reward of 3 ether( epoch 1 stake + additional 2 epoch for which he didnt unstake)
fjordStaking.stake(1 ether); // Bob stakes another 1 ether but his unclaimed rewards doesnt increase
fjordStaking.stake(1 ether); // Bob stakes another 1 ether but his unclaimed rewards doesnt increase
(
totalStaked,
unclaimedRewards,
unredeemedEpoch,
lastClaimedEpoch
) = fjordStaking.userData(address(bob));
console.log("unclaimedRewards", unclaimedRewards);
console.log("unredeemedEpoch", unredeemedEpoch);
vm.prank(bob);
fjordStaking.claimReward(false); // Bob can still claim his rewards
}
Impact
This understates a users expectations as all his rewards does not get updated
Recommendation
I really cant say a proper fix for now as there are lots of abstractions and internal logics going on so as not to distrup other part of the system.
Updates
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.