Submitted by SpicyMeatball, also found by mert_eren, nonseodion, cducrest, immeas, popular00, 0xComfyCat, GREY-HAWK-REACH, Yanchuan, ppetrov, kaden, and pep7siup
In the LendingLedger contract, a user is rewarded with CANTO tokens depending on how long he has his deposit in the market. Rewards are distributed for each week during which the deposit was inside the market. However, the user can cheat this condition because we are rounding down to the start of the week, so the user can deposit at 23:59 at the end of the week and withdraw at 00:00 and still get rewarded as if he had his deposit for the whole week.
Foundry
Its difficult to propose a solution for this exploit without major changes in the contracts architecture. Perhaps we can somehow split the amount based on the time the sync was made inside the week, lets say Alices last_sync was in the middle of week0, she deposited 1 ether, thus her amount for the current epoch will be 1/2 ether. However there is a caveat, how do we fill the gaps? We cant fill them with 1/2 ether. We can use this struct though,
so we can use fraction for the current epoch and actualAmount = 1 ether to fill the gaps.
alcueca (Judge) increased severity to High and commented:
OpenCoreCH (veRWA) commented:
OpenCoreCH (veRWA) confirmed on duplicate finding #71
