Portion of the reward remains undistributed if the first staker arrives after notifyReward call

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/UniStaker.sol#L584

Vulnerability details

Impact

Portion of the reward remains unused in the contract if the first staker arrives after notifyReward call.

Proof of Concept

When notifyReward is called the staking contract calculates the reward rate per second and saves the end of the distribution timestamp.
https://github.com/code-423n4/2024-02-uniswap-foundation/blob/main/src/UniStaker.sol#L570

    // We checkpoint the accumulator without updating the timestamp at which it was updated, because
    // that second operation will be done after updating the reward rate.
    rewardPerTokenAccumulatedCheckpoint = rewardPerTokenAccumulated();

    if (block.timestamp >= rewardEndTime) {
      scaledRewardRate = (_amount * SCALE_FACTOR) / REWARD_DURATION;
    } else {
      uint256 _remainingReward = scaledRewardRate * (rewardEndTime - block.timestamp);
      scaledRewardRate = (_remainingReward + _amount * SCALE_FACTOR) / REWARD_DURATION;
    }

>>  rewardEndTime = block.timestamp + REWARD_DURATION;
    lastCheckpointTime = block.timestamp;

Let's say we need to distribute 10 ETH in 30 days, reward rate will be 10 * 10e18 / (86400 * 30) = 3858024691358 tokens per second. If the first staker arrives only after one day he will start accumulating rewards with a 86400 seconds delay, thus 3858024691358 * 86400 = 0.3 ETH will stay undistributed because distribution will end on day 30.

Coded POC for UniStaker.t.sol

  function test_NotAllDistributed() public {
    address alice = address(0xa11cE);
    _mintGovToken(alice, 1000e18);
    _mintTransferAndNotifyReward(10 ether);
    vm.warp(block.timestamp + 86400);
    // first staker after 1 day
    _stake(alice, 1, address(0xde1e6a7eE), alice);
    vm.warp(block.timestamp + (86400 * 300));
    uint256 reward = uniStaker.unclaimedReward(alice);
    assert(reward != 10 ether);
    console.log("REWARD: ", reward);
    // 0.3 ETH undistributed
    console.log("UNDISTRIBUTED: ", 10 ether - reward);
  }

Tools Used

Foundry

Recommended Mitigation Steps

Consider setting rewardEndTime value during the first stake after notifyReward if totalStaked == 0

Assessed type

Other

[c4-judge]

MarioPoneder marked the issue as primary issue

[c4-judge]

MarioPoneder marked the issue as duplicate of #369

[c4-judge]

MarioPoneder marked the issue as unsatisfactory:
Invalid