044.md

Radiant Orchid Pike

medium

Report on Incorrect Reward Calculation in Contract

Summary

The contract incorrectly calculates the current reward to be distributed using rewards[vault].rewardAmount instead of maxReward. This leads to an inflated result as it considers both claimed rewards and rewards still available for distribution.

Vulnerability Detail

The contract uses the total reward amount (rewards[vault].rewardAmount) in the reward calculation instead of the maximum remaining reward (maxReward = rewards[vault].rewardAmount - rewards[vault].rewardPaid), leading to inaccurate reward distribution.

Impact

from the developers's comment

 // Calculates ratio of timeframe to time since last harvest
            // Uses this ratio to determine partial reward amount or extra reward amount

partial reward amount can be calculated using the ratio of timeframe to time since last harvest. https://github.com/sherlock-audit/2024-04-alchemix/blob/main/v2-foundry/src/utils/RewardRouter.sol#L38-L43 but partial reward amount should be calculated from the available reward and not from claimed rewards.

1. Inaccurate Reward Distribution: Using rewards[vault].rewardAmount instead of maxReward inflates the reward, leading to incorrect distribution.
2. Economic Impact: Incorrect reward calculation can affect the economic balance and integrity of the contract.

Code Snippet

https://github.com/sherlock-audit/2024-04-alchemix/blob/main/v2-foundry/src/utils/RewardRouter.sol#L34-L53

Tool used

Manual Review

Recommendation

To ensure accurate reward distribution, update the calculation to use maxReward instead of rewards[vault].rewardAmount. This will provide a more precise calculation based on the actual remaining rewards to be distributed.