Ajna Protocol - Vagner's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/RewardsManager.sol#L534-L551

Vulnerability details

Impact

The function _calculateNewRewards from RewardsManager.sol could revert all the time, under certain conditions, because of an overflow, making the function claimRewards , moveStakedLiquidity and unstake unusable since they all use somehow _claimRewards which in the end calls _calculateNewRewards.

Proof of Concept

The function _calculateNewRewards gets called in the end everytime _claimRewards gets called, which happens in the functions claimRewards, moveStakedLiquidity, unstake. This function calls _getPoolAccumulators to get totalBurnedInPeriod and totalInterestEarnedInPeriod. https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/RewardsManager.sol#L526-L532 Then it uses these 2 variables to calculate newRewards_ and rewardsCapped, which are then used into an if statement. https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/RewardsManager.sol#L546-L550 newRewards_ variable can be $0$ in the case where totalInterestEarnedInPeriod is $0$ https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/RewardsManager.sol#L535-L541 In the case where newRewards_ will be $0$ and rewardsCapped will be greater than $0$ the if statement will be

if (rewardsClaimedInEpoch_ + 0 > rewardsCapped) {
            newRewards_ = rewardsCapped - rewardsClaimedInEpoch_;
        }

which means that every time that the if statement will be true the subtraction will revert since it will overflow, rewardsCapped being less than rewardsClaimedInEpoch_ . This means that if a user have the totalInterestEarnedInPeriod $0$ but the totalBurnedInPeriod greater than $0$ the subtraction under the if statement could revert making claimRewards , moveStakedLiquidity and unstake reverting as well.

Tools Used

Manual audit

Recommended Mitigation Steps

Take into consideration this specific case since that could make most of the rewards mechanics for an user break.

Assessed type

Under/Overflow