Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Users Unable to Claim Rewards After First Claim Due to Incorrect Reward Tracking

ace_30

Summary

The `claimRewards()` function incorrectly updates `userRewards[user]`, causing users to lose access to unclaimed rewards and preventing them from claiming rewards after their first claim.

Vulnerability Details

In the claimRewards() function, the contract incorrectly updates userRewards[user] by setting it to totalDistributed instead of properly updating it with the claimed rewards:

function claimRewards(address user) external override nonReentrant whenNotPaused returns (uint256) {
--snip--
uint256 pendingReward = _calculatePendingRewards(user);
if (pendingReward == 0) revert InsufficientBalance();
// Reset user rewards before transfer
userRewards[user] = totalDistributed;
--snip--
}

Since totalDistributed represents the total rewards distributed to all users, this could lead to incorrect calculations in _calculatePendingRewards() for subsequent claims:

function _calculatePendingRewards(address user) internal view returns (uint256) {
--snip--
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}

As a result, users lose access to unclaimed rewards.

Note: Suppose a user is eligible for 1% of totalDistributed. Their pendingReward will remain 0 until totalDistributed increases 100 times.

Impact

Users will be unable to claim any further rewards after their first claim.

Tools Used

vscode

Recommendations

Just add the pendingReward:

userRewards[user] += pendingReward;
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

FeeCollector::claimRewards sets `userRewards[user]` to `totalDistributed` seriously grieving users from rewards

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.