Abracadabra Mimswap - AgileJune's results

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/main/src/staking/LockingMultiRewards.sol#L388

Vulnerability details

Impact

LockingMultiRewards.sol, Users can get rewards less than expected amount because of rounding error on calculation of rewardRate. If rewardToken is token of low decimals, like GUSD, which is stablecoin token with 2 decimals.

Proof of Concept

In LockingMultiRewards.sol::notifyRewardAmount, rewardRate is calculated as following.

reward.rewardRate = amount / _remainingRewardTime;

The maximum of _remainingRewardTime is 7 * 24 * 3600 = 604_800, so if operator tries to notify GUSD reward amount less than 604800 ($6048) at the start of epoch, it always reverts with the line (https://github.com/code-423n4/2024-03-abracadabra-money/blob/main/src/staking/LockingMultiRewards.sol#L384)

Even though reward amount is greater than 604800($6048), there will be precision issue, that is, real rewarded amount is less than notified amount.

POC example:

let's say that only a user staked and all rewards will be awarded to the user.

reward amount: 1_000_000
remainingRewardTime: 604_800
reward period: 604_800

rewardRate = 1_000_000 / 604_800 = 1
real reward = rewardRate * 604_800 = 604_800

diff = 1_000_000 - 604_800 = 395200 ($3952)

It will affect the protocol's reputation, so we need to add precision value

Tools Used

Manual Review

Recommended Mitigation Steps

We need to add precision value.

    function notifyRewardAmount(address rewardToken, uint256 amount, uint minRemainingTime) public onlyOperators {
......
-	amount += _remainingRewardTime * reward.rewardRate;
+	amount += _remainingRewardTime * reward.rewardRate / 10 ** 18;
......
-	reward.rewardRate = amount / _remainingRewardTime;
+	reward.rewardRate = amount * 10 ** 18 / _remainingRewardTime;
......
    }

    function rewardsForDuration(address rewardToken) external view returns (uint256) {
-        return _rewardData[rewardToken].rewardRate * rewardsDuration;
+        return _rewardData[rewardToken].rewardRate * rewardsDuration / 10 ** 18;
    }

    function _rewardPerToken(address rewardToken, uint256 lastTimeRewardApplicable_, uint256 totalSupply_) public view returns (uint256) {
......
-        uint256 pendingRewardsPerToken = (timeElapsed * _rewardData[rewardToken].rewardRate * 1e18) / totalSupply_;
+        uint256 pendingRewardsPerToken = (timeElapsed * _rewardData[rewardToken].rewardRate) / totalSupply_;
......
    }

Assessed type

Math