Core Contracts

Summary

Depositors can unfairly earn rewards equivalent to long-term stakers because the earned function relies on veToken.balanceOf().

Vulnerability Details

• The earned function calculates a depositor’s share of rewards and is invoked whenever the `updateReward modifier is called.

• For new depositors, state.rewardPerTokenPaid is initialized to 0. This allows them to claim rewards starting from the full accumulated getRewardPerToken value (equivalent to the oldest depositor’s initial state).

Suppose two depositors, A (old) and B (new), have identical getUserWeight.

For depositor B (new):
userStates[B].rewardPerTokenPaid = 0

For depositor A (old):
userStates[A].rewardPerTokenPaid = rewardPerTokenStored (updated value)
Both depositors end up receiving the same reward amount, which violates expectations.

• the reason behind the issue is earned function rely on getUserWeight to calculate user commission from rewards. (which is the same as A user have during the first depositing by B user)

Impact

• loss of profit from staking by depositors.

Tools Used

Manual audit

Recommendations

To calculate user rewards accurately, you should likely reference _balances[account] to ensure the correct depositor’s balance is used.