sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Reward tokens are lost in the period where there are no stakers, but reward distribution has started

    Holoride: DeFi Token

    Severity
    High
    Status
    Fixed
    Location(s)

    https://github.com/sub7security/holoride-defi/blob/0557444ec0b3a4df44e0cf6c9bcd8e06eaea63c4/contracts/Farming.sol#L89-L96

    Description

    Each time funders fund the farming contract, endBlock duration is extended based on the amount funded, some multiples of rewardPerBlock. This reward will only be fully utilised if in the duration from startBlock to endBlock, there must be at least 1 user who has deposited liquidity into the pool, i.e. pool.lpToken.balanceOf(address(this)) > 0.

    Here are a few scenerios that the loss will happen in.

    1. Farming contract is funded, no stakers have staked LP tokens yet, but block.number >= startBlock.
    2. All of liquidity is withdrawn by users before the end of farming period and farming period has already started.

    Impact is that reward tokens funded into contract will be lost propotionately to the amount of blocks that have been mined for as long as there are no liquidity added, and will not be recoverable even if liquidity is added at a later block.

    Recommendation

    One way we can prevent loss of funded tokens, would be for owner to deposit 1 wei of LP token before the startPeriod and only withdraw after endPeriod. We can either choose to implement this deposit on the smart contract level, or document it such that owner will remember to deposit when the farming contract is deployed. This way, all farming rewards will be captured and since it is only 1 wei, it will not impact rewards that actual user can farm by much.

    Comments
    No comments yet

    Reward tokens are lost in the period where there are no stakers, but reward distribution has started

    Holoride: DeFi Token

    Severity
    High
    Status
    Fixed