Core Contracts

Summary

The updatePeriod function's implementation fails to safeguard unclaimed rewards when transitioning between periods, potentially resulting in users losing access to their earned rewards.

Vulnerability Details

Current period state management in updatePeriod() overlooks unclaimed reward protection when resetting period variables. This creates risk of reward loss for users who haven't claimed before the period transition.

Key Issues:

• Reward tracking is lost when periodState.distributed resets to 0

• Period transitions occur without preserving unclaimed reward accessibility

• No mechanism exists to protect or transfer unclaimed rewards

Impact

Risk of permanent reward loss for users who fail to claim before period updates

Tools Used

• Manual code review

Recommendations

1. Add Claim Protection Period: Implement a grace period mechanism to allow reward claims during period transitions