Skip to content

Latest commit

 

History

History
35 lines (18 loc) · 1.27 KB

052.md

File metadata and controls

35 lines (18 loc) · 1.27 KB

Helpful Walnut Meerkat

High

earningPower Breaks Key Invariants

Summary

The reward accounting system in GovernanceStaker operates under the assumption that the weight of users' staked positions can only change through their own interactions with specific functions, such as stake and withdraw. However, the current implementation links the earningPower of delegatees to multiple users. This causes earningPower changes to affect all linked users collectively, rather than adjusting individually for each user linked to a delegatee.

Root Case

This function modifies the score of delegatees, which directly should impacts the weight of multiple users' positions. As a result, desynchronization occurs in the rates at which users should earn rewards.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

  • Some users could earn higher rewards than intended, while others might earn significantly less or no rewards at all to offset those gains.

Mitigation

Change the approach to ensure that these adjustments occur automatically through user-initiated interactions.