Lines of code

Vulnerability details

Impact

Users can grief reward distributions by spending dust

Proof of Concept

If a reward is targeted for an epoch in the past, a user can front-run the txn in the mempool and call addRewardToEpoch() with a dust amount at an epoch after the one in question. This will cause the transaction in the mempool to revert

File: contracts/ExtraRewardsDistributor.sol   #1

74               require(len == 0 || rewardEpochs[_token][len - 1] < _epoch, "Cannot backdate to this epoch");

<https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/ExtraRewardsDistributor.sol#L74&gt;

Tools Used

Code inspection

Recommended Mitigation Steps

Allow the backdating of rewards, which will cost more gas

The text was updated successfully, but these errors were encountered:

All reactions