Summary

Small rewards may be absorbed leading to asset loss

Vulnerability Details

In the LSTRewardsSplitter contract, when the splitRewards function processes very small rewards, it may lead to asset loss. Specifically:

1. If _rewardsAmount is very small, when calculating each receiver's share, amount may become 0 due to rounding:

When amount is 0, no transfer operation will be executed:

Even if no rewards are actually distributed, principalDeposits will still be updated:

Impact

This may cause small rewards to be "absorbed" as they are counted into principalDeposits but not actually distributed to anyone. Long-term accumulation may lead to significant asset loss.

Tools Used

vscode

Recommendations

1. Set a minimum reward threshold, only execute distribution when _rewardsAmount exceeds a certain value.

2. Use more precise calculation methods when calculating amount to avoid 0 values due to rounding.

3. Track undistributed small rewards and distribute them when accumulated to a certain amount.

4. Check if actual reward distribution has occurred before updating principalDeposits.