Lines of code

Vulnerability details

Impact

Calculation could result in truncation.

Proof of Concept

Staking.sol#L60-L64 :

function earned(address account) public view override returns (uint256 _earned) {
    return balanceOf(account) * (rewardPerToken() - userRewardPerTokenPaid[account]) / 1e18 + rewards[account];
}

above function calculates earned value by dividing the remaining reward with 1e18. here, 1e18 is such a huge value. This would possibly lead to truncation.

Tools Used

Manual review

Recommended Mitigation Steps

function earned(address account) public view override returns (uint256 _earned) {
    ---return balanceOf(account) * (rewardPerToken() - userRewardPerTokenPaid[account]) / 1e18 + rewards[account];
    +++return (balanceOf(account) * (rewardPerToken() - userRewardPerTokenPaid[account])) / 1e18 + rewards[account];
}

The text was updated successfully, but these errors were encountered:

All reactions