Submitted by SpicyMeatball
https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/BonusManager.sol#L136 https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/AccountManager.sol#L363-L387 https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L249
User rewards are not harvested during lock duration updates, leading to inconsistencies in accrued rewards between users.
In the current LockManager implementation, schnibbles rewards are harvested during lock and unlock calls.
Schnibbles reward rate depends on amount locked and the passed time.
There is also a bonus that depends on the users lock duration setting.
Users have an option to change their lock duration during ongoing locks.
The issue arises when user rewards are not harvested before the update. This leads the protocol to assume that the user had the updated duration from the beginning of the lock, resulting in incorrect reward calculations.
Coded POC for SpeedRun.t.sol:
In the provided test case, two players lock a similar amount of tokens for the same duration and then update it. Player 0 harvests rewards before duration update, while Player 1 does not. This scenario leads to a discrepancy in rewards.
Foundry
Harvest user rewards before updating lock duration:
0xinsanity (Munchables) commented:
0xsomeone (judge) confirmed and commented:
For this audit, 7 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by MrPotatoMagic received the top score from the judge.
The following wardens also submitted reports: Bauchibred, Walter, merlinboii, bigtone, 0xAkira, and Deivitto.
