Submission Details
Severity:
Malicious user can claim more fee awards than they deserve (sniping attack)
Summary
Malicious user can claim more fee awards than they deserve
Vulnerability Details
Because of broken formula in _calculatePendingAwards fn, late users will receive more than expected awards.
So attacker will wait until totalDistributed is large:
Deposits large amount to get high voting power briefly
Claims rewards based on current VP ratio
Withdraws immediately
Impact
Malicious users can drain funds from the fee service contract
Tools Used
Manual review
Recommendations
Updates
Lead Judging Commences
inallhonesty about 2 months ago
Submission Judgement Published Assigned finding tags:
StabilityPool::calculateRaacRewards is vulnerable to just in time deposits
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.