Submitted by cmichel
The ERC20Rewards._updateRewardsPerToken function exits without updating rewardsPerToken_.lastUpdated if totalSupply is zero, i.e., if there are no tokens initially.
This leads to an error if there is an active rewards period but no tokens have been minted yet.
Example: rewardsPeriod.start: 1 month ago, rewardsPeriod.end: in 1 month, totalSupply == 0.
The first mint leads to the user (mintee) receiving all rewards for the past period (50% of the total rewards in this case).
The first mintee receives all pending rewards when they should not receive any past rewards.
This can easily happen if the token is new, the reward period has already been initialized and is running, but the protocol has not officially launched yet.
Note that setRewards also allows setting a date in the past which would also be fatal in this case.
Recommend that the rewardsPerToken_.lastUpdated field must always be updated in _updateRewardsPerToken to the current time (or end) even if _totalSupply == 0. Dont return early.
alcueca (Yield) confirmed:
alcueca (Yield) patched:
