REWARD_TOKEN can be locked in the UniStaker when no deposit exists

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/cde876f5eed60eb2df4104cf031ddc21b1f538b9/src/UniStaker.sol#L570

Vulnerability details

Impact

The reward will be locked when no deposit exists in the current UniStaker contract.

Proof of Concept

When no deposit exists in the current contract, which means the stake amount is 0.
However, the reward notifier can arbitrarily to invoke notifyRewardAmount to add the new rewards.

    if (block.timestamp >= rewardEndTime) {
      scaledRewardRate = (_amount * SCALE_FACTOR) / REWARD_DURATION; //@audit what if end a long time ago? check challenge.cc
    } else {
      uint256 _remainingReward = scaledRewardRate * (rewardEndTime - block.timestamp);
      scaledRewardRate = (_remainingReward + _amount * SCALE_FACTOR) / REWARD_DURATION;
    }

Assume the scaledRewardRate is 10 * SCALE_FACTOR, after 900 seconds, the first stake coming, the checkpoint will be updated and the reward start.

However, no rewards are distributed among the first 900 seconds, the 10 * 900 rewards will be locked.

Reference: https://code4rena.com/reports/2022-09-y2k-finance#m-15-rewards-are-not-rolled-over

Tools Used

Manual

Recommended Mitigation Steps

Adding additional flags to record the 0 deposit timestamp and accumulated rewards. And consider rolling it back to the staking reward.

Assessed type

Other

[c4-judge]

MarioPoneder marked the issue as duplicate of #9

[c4-judge]

MarioPoneder marked the issue as duplicate of #369

[c4-judge]

MarioPoneder marked the issue as unsatisfactory:
Invalid