Insufficient Reward Distribution

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/UniStaker.sol#L570
https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/UniStaker.sol#L638

Vulnerability details

Impact:

Whenever a reward notifier initiates a reward cycle, it aims to distribute X amount of rewards during the duration of that cycle.

When there are no funds staked in the contract and it is notified for an award the amount of award that needs to be shared between of notifyRewardAmount() and the first stake() will remain locked in the account and will not be distributed.

There are no incentives to keep your tokens staked in the contract when there are no active rewards being distributed nor penalties for unstaking. Consequently, users may choose to stake their tokens only when rewards are available and unstake them when there are none.

Proof of Concept

Here is a coded POC which can be directly pasted in UniStaker.t.sol

function test_InsufficientRewardDistribution(
  ) public {
    address _depositor = makeAddr("_depositor");
    uint256 _stakeAmount = 1e18;

    uint256 _rewardAmount = 2_592_000e18; // 1 month in seconds * 1e18
     //first rewards are destributed without any stakes
    _mintTransferAndNotifyReward(_rewardAmount); 

    _jumpAheadByPercentOfRewardDuration(50);
    _boundMintAndStake(_depositor, _stakeAmount, _depositor); // depositor stakes
    _jumpAheadByPercentOfRewardDuration(51);

    _mintTransferAndNotifyReward(_rewardAmount); // more rewards are destributed
    _jumpAheadByPercentOfRewardDuration(101);

    vm.prank(_depositor);
    uniStaker.claimReward(); // depositor claims rewards

    console2.log("_depositor: balance ", uniStaker.REWARD_TOKEN().balanceOf(address(_depositor)));
    // _depositor: balance  3_888_000e18
    console2.log("unistaker: balance ", uniStaker.REWARD_TOKEN().balanceOf(address(uniStaker)));
    //locked unistaker: balance  1_296_000e18
  }

Tools Used:

• Manual analysis

Recommendation:

Implement a mechanism to flag rewards that indicates that there are rewards that the contract was notified before any deposits. Use that flag to start the distribution upon the first stake.

Assessed type

Other

[c4-judge]

MarioPoneder marked the issue as duplicate of #9

[c4-judge]

MarioPoneder marked the issue as duplicate of #369

[c4-judge]

MarioPoneder marked the issue as unsatisfactory:
Invalid