Skip to content
This repository has been archived by the owner on Oct 1, 2023. It is now read-only.

ltyu - Carousel vaults without any deposits will lose emissions #49

Closed
sherlock-admin opened this issue Mar 27, 2023 · 0 comments
Closed
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Medium A valid Medium severity issue Reward A payout will be made for this issue

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented Mar 27, 2023

ltyu

high

Carousel vaults without any deposits will lose emissions

Summary

Carousels that have emissions that end as null events, will cause one/both side(s) to lose emissions tokens.

Vulnerability Detail

When a Carousel is created, it can have emissions added to the epoch. Currently, when the epoch ends (with/out a depeg event), the depositors can claim their share of emissions. However, when there are no depositors for that epoch, emissions cannot be claimed. This is resolved as a null epoch. No one will have the epoch's tokens to burn and claim the emissions (done within withdraw()).

Impact

This is high impact because emission tokens will be lost in null epoch. Currently, there is no way to recover unclaimed tokens.

Code Snippet

Emission tokens are added:
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/CarouselFactory.sol#L132-L153

Emission tokens are calculated upon withdraw(). If there is a null epoch, no one will have that epoch's tokens, burns will revert, and thus emissions cannot be claimed:
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L154-L157

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L630-L636

Tool used

Manual Review

Recommendation

Consider allowing emissions to be reclaimed by treasury, or possibly, rolled over to another epoch.

Duplicate of #122

@github-actions github-actions bot closed this as completed Apr 3, 2023
@github-actions github-actions bot added Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label labels Apr 3, 2023
@sherlock-admin sherlock-admin added the Reward A payout will be made for this issue label Apr 11, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Medium A valid Medium severity issue Reward A payout will be made for this issue
Projects
None yet
Development

No branches or pull requests

1 participant