Core Contracts

Summary

In the MarketCreator contract, rewards are calculated based on the current total deposits at redemption time. This design allows users who deposit later to receive rewards comparable to long-term depositors—even if they commit for a shorter duration—because the reward share is not locked in at deposit time.

Vulnerability Details

The contract calculates a depositor’s reward as:

where market.reward is the total reward pool and market.totalDeposits is updated as deposits and redemptions occur.
Because market.totalDeposits is determined at redemption time, a new depositor who joins later can wait until many long-term depositors have redeemed, reducing the denominator. As a result, a late depositor may receive the same—or even a higher—proportional reward share as those who deposited earlier, despite committing for a shorter period. This mechanism undermines the incentive for long-term commitment, as all depositors, regardless of their deposit timing, effectively receive similar reward shares based solely on the current deposit pool.

Impact

• Unfair Reward Distribution:
  Late depositors can free ride on the reward pool, eroding the benefits intended for early, long-term participants.

• Reduced Incentives for Early Commitment:
  The lack of differentiation between early and late depositors may discourage users from committing their funds for longer periods, undermining the market's design.

Tools Used

manual review

Recommendations

Record a snapshot of market.totalDeposits at the time of each deposit, and use that fixed value for reward calculations. This ensures that each depositor’s share of the reward pool is determined at entry.