Users cannot receive rewards from ConcentratedLiquidityPoolManager
if their liquidity is too large
#88
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Warden finding
sponsor acknowledged
Technically the issue is correct, but we're not going to resolve it for XYZ reasons
Handle
broccoli
Vulnerability details
Impact
There could be an integer underflow error when the reward of an incentive is claimed, forcing users to wait for a sufficient period or reduce their liquidity to claim the rewards.
Proof of Concept
The unclaimed reward that a user could claim is proportional to the
secondsInside
, which is, in fact, proportional to the position's liquidity. It is possible that the liquidity is too large and causessecondsInside
to be larger thansecondsUnclaimed
. As a result, the rewards that the user wants to claim exceed theincentive.rewardsUnclaimed
and causes an integer underflow error, which prevents him from getting the rewards.Referenced code:
ConcentratedLiquidityPoolManager.sol#L94-L95
Recommended Mitigation Steps
Check whether the
rewards
exceeds theincentive.rewardsUnclaimed
. If so, then send onlyincentive.rewardsUnclaimed
amount of rewards to the user.The text was updated successfully, but these errors were encountered: