Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Reward rate manipulation through staking and withdrawing

falendar

Summary

In the BaseGauge contract, a large staker can manipulate reward rates by withdrawing their stake to drastically reduce totalSupply.

Vulnerability Details

Staking increases and withdrawing decreases totalSupply. The getRewardPerToken calculation depends on totalSupply as denominator:

function getRewardPerToken() public view returns (uint256) {
if (totalSupply() == 0) {
return rewardPerTokenStored;
}
​
return rewardPerTokenStored + (
> (lastTimeRewardApplicable() - lastUpdateTime) * rewardRate * 1e18 / totalSupply()
);
}

Example scenario (for illustration purposes, assume the whale holds 80% of the pool):

Initial state:
rewardRate = 100e18
timeDiff = 3600 (1 hour)
totalSupply = 10000e18 (10000 staked tokens)
Whale has 8000e18 (80% of stake)
Other users have 2000e18 (20% of stake)
​
Normal rewardPerTokenStored:
(3600 * 100e18 * 1e18) / 10000e18 = 36e18
​
After whale withdraws:
totalSupply = 2000e18
rewardPerTokenStored = (3600 * 100e18 * 1e18) / 2000e18 = 180e18

  • Withdrawing 8000 tokens leaves 2000 in pool, which increases rewardPerTokenStored 5 times

  • Staking/withdrawing has no cooldown

Impact

High: Large stakers can manipulate reward rates, leading to unfair reward distribution.

Recommendations

Consider implementing a cooldown mechanism for staking and withdrawing or fixing the calculations to prevent manipulation of reward rates through totalSupply changes.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge reward system can be gamed through repeated stake/withdraw cycles without minimum staking periods, allowing users to earn disproportionate rewards vs long-term stakers

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

BaseGauge reward system can be gamed through repeated stake/withdraw cycles without minimum staking periods, allowing users to earn disproportionate rewards vs long-term stakers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!