KupiaSec - When the startBlock is reset, the lastRewardBlocks of the pools are not updated accordingly

[sherlock-admin2]

KupiaSec

high

When the startBlock is reset, the lastRewardBlocks of the pools are not updated accordingly

Summary

The SophonFarming.setStartBlock() function resets the startBlock value, but does not update the lastRewardBlocks of the pools.

Vulnerability Detail

When the setStartBlock() function is called, it only updates the startBlock value, but does not reset the lastRewardBlocks of the pools.

In the normal situation, the lastRewardBlocks of the pools are initialized to the startBlock value in the add() function. However, if the owner later resets the startBlock to a value smaller than the original one, the lastRewardBlocks will remain set to the previous, higher startBlock value.

As a result, when the first update of the pools is performed, the rewards will be miscalculated. The system will assume the point distribution started from the old, higher startBlock value, instead of the new, lower startBlock value. This is because the blockMultiplier is calculated based on the lastRewardBlock.

This mismatch in startBlock and lastRewardBlock values leads to an incorrect rewards calculation, resulting in a loss of points for the users.

Impact

If the owner resets the startBlock to a value smaller than the previous one, users will lose a portion of their accumulated reward points.

Code Snippet

https://github.com/sherlock-audit/2024-05-sophon/blob/main/farming-contracts/contracts/farm/SophonFarming.sol#L272-L280

Tool used

Manual Review

Recommendation

When the setStartBlock() function is called, the lastRewardBlocks of the pools should also be reset, in addition to the startBlock.

Duplicate of #108

[sherlock-admin4]

1 comment(s) were left on this issue during the judging contest.

0xmystery commented:

valid because lastRewardBlock for each pool should indeed sync with the latest startBlock

[mystery0x]

This report should be valid as it described scenario 2 of #108.