rvierdiiev - assetState_.lastRewardGlobal is not cleared during deposit

[sherlock-admin]

rvierdiiev

high

assetState_.lastRewardGlobal is not cleared during deposit

Summary

When new deposit is done to the stargate, then all earned rewards are sent to the caller. Because assetState_.lastRewardGlobal is not reset to 0 as it's done for other functions that work with balance, then rewards distribution becomes incorrect and broken.

Vulnerability Detail

User can claim rewards using burn, decreaseLiquidity and claimReward functions. All of them then set assetState_.lastRewardGlobal to 0. This variable tracks the increase of earned rewards fro the contract between rewards claiming. Once rewards are claimed, then it should be cleared.

AbstractStakingAM contract incorrectly assumes, that only withdrawing from LP_STAKING_TIME claims rewards. This is not true and when deposit occurs, then rewards are claimed as well.

When user deposits to AbstractStakingAM then rewards are claimed, but assetState_.lastRewardGlobal is not set to 0. As result, rewards distribution will be incorrect. Also for some time _getRewardBalances function will revert because of underflow as _getCurrentReward will likely return smaller value than assetState_.lastRewardGlobal. After some time function will continue working again.

Impact

Rewards accounting is corrupted, contract can be dosed for some time.

Code Snippet

Provided above

Tool used

Manual Review

Recommendation

As deposit also claims rewards, then you need to clear assetState_.lastRewardGlobal variable.

Duplicate of #38