Furry Carob Chinchilla - Vouchers pool rewards are always taxed

[sherlock-admin2]

Furry Carob Chinchilla

Medium

Vouchers pool rewards are always taxed

Summary

In EthosVouch::_rewardPreviousVouchers, when previous vouchers receive rewards from a new voucher, their reward is added to their vouch.balance. This is an issue because when they unvouch, they will taxed for exiting. The idea of increasing vouchers' balance is to enable autocompounding, but this as said will tax their rewards, which is not what the users expect.
The solution to this is to use EthosVouch::_depositRewards for rewarding previous vouchers or introduce a flag for auto-compounding and leave the users to decide whether they want to use auto compounding

Root Cause

In EthosVouch::_rewardPreviousVouchers the rewards of the previous vouchers is rewarded with increasing their balance instead of depositing it to their rewards.

Internal pre-conditions

• The exit fee should be greater than 0

External pre-conditions

No response

Attack Path

• Alice vouches for the subject with id 1
• Bob vouches for the subject with id 1
• Alice vouchers and her reward is now taxed

Impact

• Vouchers will lose percentages of their reward from the vouchers pool

PoC

No response

Mitigation

Introduce a flag for enabling auto-compounding or use EthosVouch::_depositRewards to distribute the vouchers' rewards