Lines of code

Vulnerability details

Impact

When users attempt to claim rewards, the contract calculates the claimEnd and subsequently updates the userClaimedEpoch using claimEnd + WEEK. This might result in misaligned epochs in scenarios where _claimUpToTimestamp is less than or more than a week. If not correctly aligned, users could potentially claim incorrect reward amounts or even double-claim for specific epochs.

Proof of Concept

Misaligned Epochs: When _claimUpToTimestamp is taken as less than a week, and the subsequent calculation of userClaimedEpoch[_market][lender] = claimEnd + WEEK; occurs, epochs can overlap, potentially allowing double-claiming.

Potential Claiming Gaps: If _claimUpToTimestamp is more than a week, there’s a risk of creating a gap where rewards for certain epochs might be skipped entirely.

Tools Used

Recommended Mitigation Steps

Refactor Epoch Calculation: Adjust the userClaimedEpoch setting mechanism to be dynamic based on the actual duration of _claimUpToTimestamp. This ensures alignment with expected epoch boundaries.

Assessed type

Other

The text was updated successfully, but these errors were encountered:

All reactions