Submitted by TrungOre
LPFarming.sol#L190
Reward will be locked in the farming, when user execute a direct transfer with lpToken to farm without using deposit.
pls add this test to LpFarming.ts to check
In the test above, the attacker transfers 100 lpToken to the farm without using deposit function, and alice deposit 100 lpToken. Because the contract uses pool.lpToken.balanceOf(address(this)) to get the total supply of lpToken in the pool, it will sum up 100 lpToken of attacker and 100 lpToken of alice. This will lead to the situation where Alice will only be able to claim 500 token (at epoch.endBlock), the rest will be locked in the pool forever. Not only with this pool, it also affects the following, a part of the reward will be locked in the pool when the farm end.
typescript
Declare a new variable totalLPSupply to the struct PoolInfo, and use it instead of pool.lpToken.balanceOf(address(this)).
spaghettieth (JPEGd) confirmed, but disagreed with High severity and commented:
spaghettieth (JPEGd) resolved and commented:
LSDan (judge) decreased severity to Medium and commented:
