Skip to content

Latest commit

 

History

History
21 lines (14 loc) · 1.46 KB

008.md

File metadata and controls

21 lines (14 loc) · 1.46 KB

Fierce Lace Squirrel

High

When someone _stakeMore(), will reduce others' unclaimed reward

Summary

When someone _stakeMore(), the total earning power will increase. And he will claim more ratio than others rewards. While if others didn't claim theirs rewards, their earning money doesn't change. Then when he claim his reward, he will lose part of the reward during the time when he didn't claim and someone didn't _stakeMore().

Vulnerability Detail

We have two people, Alice and Bob. Alice didn't claim her rewards until bob _stakeMore(). When Bob _stakeMore(), the totalEarningPower increase and Alice's earingPower keeps same which will lead to Alice's ratio of reward decrease. When Alice claim her rewards, she will use the ratio of her earning power and the total earning power now to get her rewards. She lose the part rewards before the Bob _stakeMore(). Given an example, Alice has earning power of a and Bob has earning power of b. Alice should have reward of a/(a+b) when Bob didn't stakeMore(). After Bob stakeMore() x, Alice will have the ratio of the rewards of a/(a+b+x). After Bob StakeMore(), Alice can only clarim a/(a+b+x) ratio of rewards. If Alice didn't claim the rewards before Bob stakeMore(), she will lose part of rewards.

Impact

When someone _stakeMore(), will reduce others' unclaimed reward

Code Snippet

https://github.com/sherlock-audit/2024-11-tally/blob/main/staker/src/GovernanceStaker.sol#L710-L745

Tool used

Manual Review

Recommendation