In method splitRewards()
there is a missing check of rewardsThreshold()
. Which can lead to malicious user calling it at a frequency so that fee receivers don't earn any fees.
https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/lstRewardsSplitter/LSTRewardsSplitter.sol#L116C1-L125C6
Because of external visibility a malicious user can call this method with certain frequency so that the fee receivers don't earn any fees. As the fees are rounded down during calculation.
This will lead to fee receivers earning no fee and all the rewards getting added to the principalDeposits
.
Vs Code
Only trusted users should be allowed to call this method as the external visibility of the method can have above mentioned impact.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.