0xrice.cooker - Wrong intergation with Stargate's LPStakingTime contract leads to all users earn less interest than expected and rewards got stuck in StakedStargateAM contract

[sherlock-admin2]

0xrice.cooker

high

Wrong intergation with Stargate's LPStakingTime contract leads to all users earn less interest than expected and rewards got stuck in StakedStargateAM contract

Summary

Wrong intergation with Stargate's LPStakingTime contract leads to all users earn less interest than expected and rewards got stuck in StakedStargateAM contract

Vulnerability Detail

Stagate's LPStakingTime have no method to specialise to only withdrawing reward out. Due to that, LPStakingTime.deposit() and LPStakingTime.withdraw() beside depositing/withdraw funds, it will also send the accumulated reward to the caller.

In StakedStargateAM, we don't have any logic to store the value of received reward during a call deposit() and withdraw(), hence the protocol is not even know that the reward is already distribute

Impact

This will lead to user who owns StakedStargateAM NFT will lose majority of reward. And the StakedStargateAM contract have the no method to take the un distribute reward out

Code Snippet

https://github.com/sherlock-audit/2023-12-arcadia/blob/de7289bebb3729505a2462aa044b3960d8926d78/accounts-v2/src/asset-modules/Stargate-Finance/StakedStargateAM.sol#L82C1-L97C6

https://basescan.org/address/0x06Eb48763f117c7Be887296CDcdfad2E4092739C#code#F1#L159

https://basescan.org/address/0x06Eb48763f117c7Be887296CDcdfad2E4092739C#code#F1#174

Tool used

Manual Review

Recommendation

+   uint256 cache;
    
    function _stake(address asset, uint256 amount) internal override {
+	cache += LP_STAKING_TIME.pendingEmissionToken(assetToPid[asset], address(this));
        ERC20(asset).approve(address(LP_STAKING_TIME), amount);

        LP_STAKING_TIME.deposit(assetToPid[asset], amount);
    }

    function _withdraw(address asset, uint256 amount) internal override {
+	cache += LP_STAKING_TIME.pendingEmissionToken(assetToPid[asset], address(this));
        LP_STAKING_TIME.withdraw(assetToPid[asset], amount);
    }

    function _claimReward(address asset) internal override {
+	cache = 0;
        LP_STAKING_TIME.withdraw(assetToPid[asset], 0);
    }

    function _getCurrentReward(address asset) internal view override returns (uint256 currentReward) {
-       currentReward = LP_STAKING_TIME.pendingEmissionToken(assetToPid[asset], address(this));
+       currentReward = LP_STAKING_TIME.pendingEmissionToken(assetToPid[asset], address(this)) + cache;
    }

Duplicate of #38

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

valid: some portion of the reward will be stucked in the contract; medium(1)