Submitted by novamanbg
While sending a small amount and calling getReward is a typical example of griefing which is normally considered Medium. Given the low cost of the attack and that no specific external conditions need to be met as well as the high impact for all the users of the protocol I consider it High severity.
The _getReward function in MultiFeeDistribution.sol will call _notifyUnseenReward which will execute the following:
If a small amount of token is sent directly to the contract this will mean that the unseen amount will also be very small but greater than 0. This will lead to the execution of:
reward will be the dust amount that was sent by the user. As a result, the following changes to the reward distribution will be made:
Consider the following scenario:
As you can see simply by directly sending a small amount, the rewardPerSecond was decreased drastically and the vest is now much longer.
_notifyUnseenReward should not be in functions without access control for trusted protocol roles, as griefing would always be possible. If you still want the unseen amount to be updated frequently consider value-weighted time additions to the vesting.
amarcu (LoopFi) confirmed
Koolex (judge) decreased severity to Medium and commented:
radin100 (warden) commented:
Koolex (judge) commented:
radin100 (warden) commented:
Koolex (judge) increased severity to High and commented:
Note: For full discussion, see here.
