31495 - [SC - Critical] Users cannot claim rewards from RevenueHandler ...
Submitted on May 20th 2024 at 13:55:07 UTC by @OxAnmol for Boost | Alchemix
Report ID: #31495
Report type: Smart Contract
Report severity: Critical
Target: https://github.com/alchemix-finance/alchemix-v2-dao/blob/main/src/VotingEscrow.sol
Impacts:
Permanent freezing of unclaimed yield
Description
Brief/Intro
If a user extends their lock time to the maximum amount using votingEscrow:updateLockTime
and sets maxLockEnabled
to true, the RevenueHandler:claim
function will fail when the user attempts to claim their rewards.
Vulnerability Details
The RevenueHandler:claim
function allows users to earn rewards every epoch for maintaining a veALCX position. Users can call this function at any time after locking BPT. The function calculates and distributes all the epoch rewards since the last claim to the user.
The claim
function internally calls the RevenueHandler:_claimable
function, which calculates the user's rewards for each epoch.
In line L322, the VotingEscrow:balanceOfTokenAt
function checks for the user's underlying voting power/BPT. If the user has opted for the maximum lock, the balanceOfTokenAt function will return the maximum balance.
Let's say a user initially sets a lock end time of 90 days. After 2 epochs (4 weeks), they decide to extend the lock time to the maximum (1 year) by calling updateLockTime
with maxLockEnabled
set to true.
If they then try to claim the rewards for the first 2 epochs from the revenue handler, the _claimable
function will behave as if they always had the maximum lock enabled. It will not account for the initial 90-day lock covering the first 2 epochs. The attempt to distribute rewards will fail because the contract will not have enough funds to distribute.
Impact Details
Users will lose rewards. This is a loss of unclaimed yield for user which is considered as high impact.
References
https://github.com/alchemix-finance/alchemix-v2-dao/blob/f1007439ad3a32e412468c4c42f62f676822dc1f/src/RevenueHandler.sol#L186
https://github.com/alchemix-finance/alchemix-v2-dao/blob/f1007439ad3a32e412468c4c42f62f676822dc1f/src/RevenueHandler.sol#L322
https://github.com/alchemix-finance/alchemix-v2-dao/blob/f1007439ad3a32e412468c4c42f62f676822dc1f/src/VotingEscrow.sol#L714
Proof of Concept
Paste this test in RevenueHandler.t.sol
We can see what are the steps taken here to reach the revert state.
Output
Last updated