Submitted by cccz
In AirdropBroker, the owner calls registerUsersForPhase with _phase = 4 to airdrop to users in epoch 4 to 8.
And the documentation says:
The problem here is that phase4Users is not cleared before the start of the 5 sub-phases of phase 4, which results in users being able to participate and exercise the epoch 4 options in epoch 5.
Consider the following scenario. There are 10,000 aoTAPs in phase 4, which means that epoch 4, 5, 6, and 7 will receive 2,500 aoTAPs respectively, and the remaining unclaimed aoTAPs will be rolled over to the next epoch.
However. Alice can participate and exercise the epoch 4 options in epoch 5, and making the total airdrop in epoch 5 become 3500 + 1000 = 4500.
https://github.com/Tapioca-DAO/tap-token//blob/20a83b1d2d5577653610a6c3879dff9df4968345/contracts/option-airdrop/AirdropBroker.sol#L321-L339
https://github.com/Tapioca-DAO/tap-token//blob/20a83b1d2d5577653610a6c3879dff9df4968345/contracts/option-airdrop/AirdropBroker.sol#L203-L220
It is recommended to delete phase4Users in newEpoch().
https://ethereum.stackexchange.com/questions/15553/how-to-delete-a-mapping
Or, add phase4Users1/phase4Users2/phase4Users3/phase4Users4/phase4Users5 mappings to store the airdrops for epochs 4 through 8, respectively.
Context
LSDan (judge) decreased severity to Low
cccz (warden) commented:
LSDan (judge) increased severity to Medium and commented:
0xWeiss (Tapioca) confirmed
Note: For full discussion, see here.
