Submitted by unforgiven, also found by 0x4non
https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantPoolBase.sol#L50-L64
https://github.com/code-423n4/2022-11-stakehouse/blob/4b6828e9c807f2f7c569e6d721ca1289f7cf7112/contracts/liquid-staking/GiantMevAndFeesPool.sol#L180-L193
Function _distributeETHRewardsToUserForToken() is used to distribute remaining reward of user and its called in _onWithdraw() of GiantMevAndFeesPool. but function withdrawETH() in GiantPoolBase dont call either of them and burn user giant LP token balance so if user withdraw his funds and has some remaining ETH rewards he would lose those rewards because his balance set to zero.
This is withdrawETH() code in GiantPoolBase:
As you can see it burn user lpTokenETH balance and dont call either _distributeETHRewardsToUserForToken() or _onWithdraw(). and in function claimRewards() uses lpTokenETH.balanceOf(msg.sender) to calculate user rewards so if user balance get to 0 user wont get the remaining rewards.
These are steps that this bug happens:
so users lose their unclaimed rewards by withdrawing their funds.
VIM
Users unclaimed funds should be calculated and transferred before any actions that change users balance.
vince0656 (Stakehouse) confirmed
