Submitted by Varun_05
https://github.com/code-423n4/2024-05-olas/blob/3ce502ec8b475885b90668e617f3983cea3ae29f/tokenomics/contracts/Dispenser.sol#L1129https://github.com/code-423n4/2024-05-olas/blob/3ce502ec8b475885b90668e617f3983cea3ae29f/tokenomics/contracts/Dispenser.sol#L878
In retain function before calculating the staking incentives which belongs to retainer for different epoches no checkpoint nominee function in vote weighing is called for retainer. Due to this retained staking, incentives may be lost and they wont be recovered ever. Marking this as high because likelihood of happening is high and impact is medium and direct loss of retained incentives.
Following is the retain function:
As can be seen from above, if the weight of retainer is not updated then the following stakingPoint.stakingIncentive * stakingWeight will return zero; thus, no incentives will be retained for that epoch even when there is staking weight left for that epoch for retainer. As this function is permissionless and external, anyone can call this and thus, can prevent the retention of staking incentives for some epoches before there is updation of weights of the retainer.
Once this function is executed for a particular epoch it can never be executed for that epoch because of the following set value:
We can also see in the calculateStakingIncentives function that in order to prevent the above error, weights of nominee is updated up to the latest time; i.e., the current block.timestamp, as can be seen from the following line of code:
Mitigation is simple just call the checkpoint nominee function with input as retainer before calculating the incentives.
Context
kupermind (Olas) confirmed
0xA5DF (judge) decreased severity to Medium and commented:
Olas mitigated
Varun_05 (warden) commented:
