Core Contracts

Summary:

The FeeCollector contract's reward calculation mechanism is vulnerable to manipulation because it calculates rewards based on current voting power without considering the duration of token lock-up. This allows users to maximize rewards by briefly locking tokens, claiming rewards, and immediately unlocking, effectively stealing rewards from long-term token lockers.

Vulnerability Details:

In the _calculatePendingRewards function:

The vulnerability exists because:

1. Rewards are calculated using current voting power snapshot

2. No consideration of when the voting power was acquired

3. No minimum lock period requirement

4. No reward vesting or distribution over time

Attack Path:

1. Wait for significant rewards to accumulate in the contract

2. Lock tokens for maximum voting power

3. Claim rewards immediately

4. Unlock tokens

5. Repeat with next reward cycle

Impact:

• Unfair reward distribution favoring tactical short-term lockers

• Diminished rewards for legitimate long-term stakers

• Undermines the incentive mechanism for long-term protocol alignment

• Potential drain of protocol rewards through repeated exploitation

Tools Used:

Manual code review.

Recommendations:

1. Implement reward tracking per epoch.

2. Add minimum lock time requirement.

3. Implement reward vesting.

4. Use time-weighted voting power.