Ethereum Credit Guild - zhaojohnson's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L409-L436

Vulnerability details

Impact

When users stake on one gauge by credit tokens at the first time, they can claim more rewards that expected.

Proof of Concept

When user try to stake on gauge A at the first time, GuildToken will try to claim existing rewards at first and then increase user's gauge weight. When we try to claim gauge rewards ,we should update userGaugeProfitIndex[user][gauge] to the latest index. However, when user stake on gauge at the first time, We do not have any weight on this gauge. This function will return 0 directly and not update userGaugeWeight to latest index.

After that, when the user want to claim rewards, the rewards will calculate rewards from 1e18(initial) to latest index. Users can claim more rewards that expected.

function claimGaugeRewards(
        address user,
        address gauge
    ) public returns (uint256 creditEarned) {
        uint256 _userGaugeWeight = uint256(
            GuildToken(guild).getUserGaugeWeight(user, gauge)
        );
        if (_userGaugeWeight == 0) {
            return 0;
        }
        uint256 _gaugeProfitIndex = gaugeProfitIndex[gauge];
        uint256 _userGaugeProfitIndex = userGaugeProfitIndex[user][gauge];
        if (_gaugeProfitIndex == 0) {
            _gaugeProfitIndex = 1e18;
        }
        if (_userGaugeProfitIndex == 0) {
            _userGaugeProfitIndex = 1e18;
        }
        uint256 deltaIndex = _gaugeProfitIndex - _userGaugeProfitIndex;
        if (deltaIndex != 0) {
            creditEarned = (_userGaugeWeight * deltaIndex) / 1e18;
            userGaugeProfitIndex[user][gauge] = _gaugeProfitIndex;
        }
        if (creditEarned != 0) {
            emit ClaimRewards(block.timestamp, user, gauge, creditEarned);
            CreditToken(credit).transfer(user, creditEarned);
        }
    }

Tools Used

Manual

Recommended Mitigation Steps

        if (_userGaugeWeight == 0) {
           // we should timely update userGaugeWeight here
          userGaugeProfitIndex[user][gauge] = _gaugeProfitIndex;
            return 0;
        }

Assessed type

Error