Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Reward rate manipulation through staking and withdrawing

falendar

Summary

In the BaseGauge contract, a large staker can manipulate reward rates by withdrawing their stake to drastically reduce totalSupply.

Vulnerability Details

Staking increases and withdrawing decreases totalSupply. The getRewardPerToken calculation depends on totalSupply as denominator:

function getRewardPerToken() public view returns (uint256) {
if (totalSupply() == 0) {
return rewardPerTokenStored;
}
​
return rewardPerTokenStored + (
> (lastTimeRewardApplicable() - lastUpdateTime) * rewardRate * 1e18 / totalSupply()
);
}

Example scenario (for illustration purposes, assume the whale holds 80% of the pool):

Initial state:
rewardRate = 100e18
timeDiff = 3600 (1 hour)
totalSupply = 10000e18 (10000 staked tokens)
Whale has 8000e18 (80% of stake)
Other users have 2000e18 (20% of stake)
​
Normal rewardPerTokenStored:
(3600 * 100e18 * 1e18) / 10000e18 = 36e18
​
After whale withdraws:
totalSupply = 2000e18
rewardPerTokenStored = (3600 * 100e18 * 1e18) / 2000e18 = 180e18

  • Withdrawing 8000 tokens leaves 2000 in pool, which increases rewardPerTokenStored 5 times

  • Staking/withdrawing has no cooldown

Impact

High: Large stakers can manipulate reward rates, leading to unfair reward distribution.

Recommendations

Consider implementing a cooldown mechanism for staking and withdrawing or fixing the calculations to prevent manipulation of reward rates through totalSupply changes.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge reward system can be gamed through repeated stake/withdraw cycles without minimum staking periods, allowing users to earn disproportionate rewards vs long-term stakers

inallhonesty Lead Judge about 2 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge reward system can be gamed through repeated stake/withdraw cycles without minimum staking periods, allowing users to earn disproportionate rewards vs long-term stakers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.