Summary

Users can frontrun sendProfit to receive rewards immediately.

Vulnerability Details

Function sendProfit is used to increase the totalProfit by sending some currency. After that, when the user claims the reward, the reward value will be the difference in totalProfit multiplied by the share. Therefore, by frontrunning sendProfit, users can stake a large number of tokens in advance and obtain more rewards.

Impact

Attackers can frontrun sendProfit to receive rewards immediately.

Tools Used

VSCode

Recommendations

The way rewards are calculated should take into account the duration of staking.