Skip to content

Latest commit

 

History

History
58 lines (41 loc) · 3.17 KB

051.md

File metadata and controls

58 lines (41 loc) · 3.17 KB

Feisty Opaque Vulture

Medium

Ineligible deposit continues to accumulate rewards due to maxBumpTip constraint in bumpEarningPower()

Summary

Keepers are incentivized to update a deposit's earning power in exchange for a fee. If the earning power is reduced to 0, it is ensured that the remaining unclaimed rewards are not less than the maxBumpTip. This prevents keepers from reducing a deposit's earning power to 0, resulting in the deposit continuing to accumulate rewards even though it should not, as its earning power is supposed to be 0.

Vulnerability Detail

In GovernanceStaker::bumpEarningPower(), if the new earning power is less than the old one, it is ensured that the remaining unclaimed rewards are not less than the maxBumpTip that a keeper can request for bumping.

  function bumpEarningPower(
    DepositIdentifier _depositId,
    address _tipReceiver,
    uint256 _requestedTip
  ) external virtual {
    ... ...
    uint256 _unclaimedRewards = deposit.scaledUnclaimedRewardCheckpoint / SCALE_FACTOR;

    (uint256 _newEarningPower, bool _isQualifiedForBump) = earningPowerCalculator.getNewEarningPower(
      deposit.balance, deposit.owner, deposit.delegatee, deposit.earningPower
    );
    if (!_isQualifiedForBump || _newEarningPower == deposit.earningPower) {
      revert GovernanceStaker__Unqualified(_newEarningPower);
    ... ...
    // Note: underflow causes a revert if the requested  tip is more than unclaimed rewards
    if (_newEarningPower < deposit.earningPower && (_unclaimedRewards - _requestedTip) < maxBumpTip)
    {
      revert GovernanceStaker__InsufficientUnclaimedRewards();
    }
    ... ...
  }

However, this means the earning power of a deposit cannot be updated to 0 as long as the deposit's unclaimed rewards are less than maxBumpTip. This is even more likely because a keeper can claim all of the unclaimed rewards when the earning power is increased. Consequently, if the deposit has not accumulated enough rewards during the updateEligibilityDelay to allow the earning power to be reduced to 0, the deposit will continue to accumulate rewards.

Although a deposit does not accumulate rewards when its earning power is 0, meaning the remaining rewards could be 0 and there would be no incentive to increase the earning power, the constraint is unnecessary. The owner of the deposit would still be incentivized to, for example, stake an amount of 0 to increase the earning power again as soon as possible, allowing the deposit to continue accumulating rewards.

Impact

Deposits will continue to accumulate rewards even though their earning power should be 0, effectively stealing rewards from other stakers.

Code Snippet

https://github.com/sherlock-audit/2024-11-tally/blob/b125d1f2b52170a3789b1060a52fc6609e6e2262/staker/src/GovernanceStaker.sol#L497-L500

Tool used

Manual Review

Recommendation

Consider changing the constraint so that the remaining rewards are not required to at least equal the maxBumpTip when the earning power is reduced. Additionally, consider applying the constraint when the earning power is increased instead, to ensure sufficient incentive remains for reducing the earning power when necessary.