#39876 [BC-Critical] Receiving rewards multiple times for the same period

Submitted on Feb 9th 2025 at 16:45:35 UTC by @Blockian for Audit Comp | Shardeum: Core III

  • Report ID: #39876

  • Report Type: Blockchain/DLT

  • Report severity: Critical

  • Target: https://github.com/shardeum/shardeum/tree/bugbounty

  • Impacts:

    • Direct loss of funds

Description

Impact

User can get rewards for an active period as many times as they want.

Root Cause

The validations in InitRewardTimes and ClaimRewards transactions aren't enough to validate that a user didn't already receive rewards for a certain activity period.

Attack Flow

  • A node stakes and becomes active in the network

  • The node calls InitRewardTime with its actual activation time

  • The node finishes being active

  • The node calls c with a large fake deactivation time

  • The reward is calculated according to the fake nodeDeactivationTime

  • The node calls InitRewardTime and ClaimRewards again with actual values

  • The node calls Ustake and receives all the reward

Deep Dive

In InitRewardsTime validation it is validated that nodeAccount.rewardStartTime >= tx.nodeActivatedTime but tx.nodeActivatedTime isn't validated against nodeAccount.rewardEndTime.

Suggested Fix

  • Validate nodeActivatedTime against nodeAccount.rewardEndTime if rewardStartTime is greater than 0.

Severity

This allows to mint arbitrary large amounts of the native token, and so is critical.

Proof of Concept

Proof of Concept

In the POC you can see a user staking and claiming rewards twice for a period that is almost identical (off by 1 second).

  1. Apply the following changes on Shardeum

  1. Run a json-rpc-server

  2. Run the following attack script:

Was this helpful?