047.md

Feisty Opaque Vulture

Medium

Fees are not transferred if the fee amount is equal to the reward amount for a deposit

Summary

When a staker calls GovernanceStaker::claimReward() to claim the rewards for a deposit, but the reward amount equals the fee amount, there are no rewards to claim, and the fee is also not transferred to the feeCollector. This results in the reward amount being stuck in the contract and the fees remaining untransferred if the deposit never accumulates rewards again due to having no staked balance.

Vulnerability Detail

Rewards can be claimed when either the owner or the claimer of a given deposit calls GovernanceStaker::claimReward(). Within _claimReward(), the feeAmount is deducted from the rewards associated with the deposit.

  function _claimReward(DepositIdentifier _depositId, Deposit storage deposit, address _claimer)
    internal
    virtual
    returns (uint256)
  {
    ... ...
    uint256 _reward = deposit.scaledUnclaimedRewardCheckpoint / SCALE_FACTOR;
    // Intentionally reverts due to overflow if unclaimed rewards are less than fee.
    uint256 _payout = _reward - claimFeeParameters.feeAmount;
    if (_payout == 0) return 0;
    ... ...
  }

However, when the feeAmount equals the reward amount, the function returns 0, and the fees are not transferred. This results in the protocol losing potential fees if the deposit does not accumulate additional rewards in the future due to all funds being withdrawn. The protocol will only receive a portion of the originally intended fees if the feeAmount is reduced.

Impact

The protocol will either lose out on the whole fee amount or at least a portion of it.

Code Snippet

https://github.com/sherlock-audit/2024-11-tally/blob/b125d1f2b52170a3789b1060a52fc6609e6e2262/staker/src/GovernanceStaker.sol#L720-L721

Tool used

Manual Review

Recommendation

The fee amount should still be transferred even when it equals the reward amount.