Core Contracts

Summary:

The FeeCollector contract's 'claimRewards' contains a critical flaw in its checkpoint logic. By setting userRewards[user] = totalDistributed, the contract prevents users from claiming future rewards because the calculated share will always be less than their checkpoint value.

Vulnerability Details:

In the claimRewards function:

The issue arises because of the reward calculation in _calculatePendingRewards:

Mathematical proof of the issue:

1. After first claim: userRewards[user] = totalDistributed

2. For any subsequent claim:

   • share = (totalDistributed * userVotingPower) / totalVotingPower

   • Since userVotingPower < totalVotingPower, then share < totalDistributed

   • Therefore share < userRewards[user] always

   • Result: returns 0, making rewards unclaimable

Impact:

• Users can only claim rewards once

• All subsequent reward distributions become unclaimable

• Breaks the entire reward distribution mechanism

• Loss of funds for users who should receive rewards

Tools Used:

Manual code review

Recommendations:

• Track claimed amount instead of total distributed.

• Alternative: Use distribution index tracking or use a cumulative rewards per share approach.