Core Contracts

Summary

In the FeeCollector contract’s pending reward calculation, the logic currently returns 0 when the computed share is less than the already recorded user rewards. However, in such cases, the correct behavior should be to return the calculated share as the pending reward, rather than defaulting to 0.

Vulnerability Details

Within the _calculatePendingRewards function, pending rewards are determined by comparing the user’s share of total rewards with their recorded rewards:

• Expected Behavior: Even if share is less than userRewards[user], the function should return share as the pending reward. This ensures that users receive their rightful pending rewards based on their share of the total distribution, regardless of previous reward records.

Impact

• Understated Pending Rewards: Users might not receive any rewards when their calculated share is less than the recorded user rewards, leading to discrepancies in reward distribution.

Tools Used

Recommendations

Correct the code to: