Maroutis - Wrong bribeCountPerPrincipleOnEpoch index update in incentivizePair function

[sherlock-admin2]

Maroutis

Medium

Wrong bribeCountPerPrincipleOnEpoch index update in incentivizePair function

Summary

In the incentivizePair function, the index bribeCountPerPrincipleOnEpoch is incorrectly incremented using incentivizeToken instead of principle. This causes the index to remain unchanged for a given principle and epoch, leading to overwriting of incentives and preventing multiple tokens from being incentivized for the same principle and epoch.

Details

In the provided code snippet:

uint lastAmount = bribeCountPerPrincipleOnEpoch[epoch][principle];
SpecificBribePerPrincipleOnEpoch[epoch][hashVariables(principle, lastAmount)] = incentivizeToken; // Overwrites existing entry
bribeCountPerPrincipleOnEpoch[epoch][incentivizeToken]++; // Incorrect increment

• The lastAmount variable retrieves the current index for the given principle and epoch.
• SpecificBribePerPrincipleOnEpoch uses this index to store the incentivizeToken.
• However, bribeCountPerPrincipleOnEpoch[epoch][incentivizeToken]++ increments the count for incentivizeToken instead of principle.
• This means lastAmount does not change for the same principle and epoch, causing subsequent incentives to overwrite the previous one.
• As a result, only one incentive token can be stored per principle and epoch, and any additional incentives overwrite existing ones.

Impact

Users querying this information will only see the last incentivized token, unaware of any previously added tokens. This can lead to users making decisions based on inaccurate data,

Mitigation

Correct the increment operation to update the index for the principle:
bribeCountPerPrincipleOnEpoch[epoch][principle]++;