Submitted by 0xRajkumar, also found by 0xlookman and carrotsmuggler
/contracts/farm-manager/src/manager/commands.rs#L240-L243
We have a claim function in the Farm Manager, which is used to claim rewards if the user has any open positions. This function updates the LAST_CLAIMED_EPOCH to the users last claimed epoch.
Additionally, we have the expand_farm function, which is used to expand farms. Technically, the farm creator can expand the farm even after the farms last reward epoch has been completed. 
Lets explore why below:
Lets say our starting epoch was 1 and the preliminary_end_epoch was 2, meaning the farm was intended only for epoch 1. However, due to the condition farm_ending_at.plus_seconds(config.farm_expiration_time) < env.block.time, the farm owner can expand the farm during epoch 2 + farm_expiration_time as well.
Now lets say even if farm expanding the farm for 2 epoch, then users who have an open position for that epoch should be able to claim reward, but this is not the case. Lets see how.
Lets say a user has an opened position claims rewards during epoch 2, then he will be able to claim reward from farm for epoch 1 only because  preliminary_end_epoch is 2 as you can see this in this function.
Whenever a user claims a reward, we maintain the LAST_CLAIMED_EPOCH. If the user tries to claim again, they will only be able to claim rewards starting from LAST_CLAIMED_EPOCH + 1.
There is a possibility that if a user claims rewards during the preliminary_end_epoch, and immediately after, the farm owner expands the farm, the user will not be able to claim rewards for the expanded epoch. This issue can occur for up to a maximum of two epochs.
Lets consider a scenario: the farms start_epoch is 1, and the preliminary_end_epoch is 2, meaning the user can currently claim rewards only for epoch 1.
Now, the user claims their reward during epoch 2. However, since the preliminary_end_epoch is still 2, the user can only claim up to epoch 1. Immediately after the users claim transaction, the farm owner expands the farm during the same epoch (epoch 2) for 1 additional epoch. This expansion updates the preliminary_end_epoch to 3.
Even though the user has an open position for epoch 2, they will not be able to claim the reward for epoch 2. This is because their LAST_CLAIMED_EPOCH is now set to 2, and they can only claim rewards starting from epoch 3. However, the user should still be able to claim rewards for epoch 2 as they had an active position during that time.
In the example above, we observed that the user is unable to claim rewards for one epoch, even though they had an open position for that epoch. This issue can extend to an additional epoch if the user claims rewards during the period between farm_ending_at and farm_ending_at.plus_seconds(config.farm_expiration_time), and the farm owner expands the farm within the same time frame but after the users claim transaction.
The impact is High because the user will not be able to claim their full reward.
For the proof of concept, lets consider the following scenario:
This illustrates how the issue prevents the user from receiving rewards for epoch 2.
We can mitigate this issue by only allowing farm expansion before preliminary_epoch - 1 only.
jvr0x (MANTRA) confirmed
3docSec (judge) commented:
