Core Contracts

Summary

The claimRewards function in the FeeCollector.sol contract incorrectly calculates pending rewards for users due to the way userRewards is updated. This flaw prevents users from claiming their rewards after the first successful claim, as the userRewards variable is inflated to the total distributed rewards instead of reflecting individual user rewards.

Vulnerability Details

In the claimRewards function, the internal function _calculatePendingRewards is called to determine the pending rewards for a user. The calculation is performed using the formula:

This calculation is correct; however, the subsequent logic for determining the pending rewards is flawed. The check returns 0 pending rewards for the user, when userRewards[user] is more than current shares, and as userRewards[user] is inflated, it would almost always return 0, preventing the users from subsequent claims.

Step-by-Step Breakdown:

1. Initial Claim: When a user first calls claimRewards, their userRewards[user] is 0. The _calculatePendingRewards function calculates the user's share based on their voting power and returns the correct amount.

2. Updating User Rewards: After the first claim, userRewards[user] is updated to totalDistributed, which represents the total rewards distributed to all users.

3. Subsequent Claims: If the user attempts to claim rewards again, the _calculatePendingRewards function is called again. However, now userRewards[user] is set to totalDistributed, which does not accurately reflect the user's actual rewards.

4. Incorrect Reward Calculation: When the function checks if share is greater than userRewards[user], it will return 0 for subsequent claims because userRewards[user] is inflated to the total distributed rewards, not the user's individual share. As a result, the user will be unable to claim their rewards a second time.

Impact

This vulnerability leads to users being unable to claim their rightful rewards after their initial claim, effectively locking them out of future rewards. This undermines the intended functionality of the reward distribution system.

Tools Used

• Manual code review

Recommendations

Update userRewards Correctly: Ensure that userRewards[user] is updated correctly by increasing it by the shares claimed during each reward claim.