user won't be able to get his rewards in case of staking with amount = 0

[code423n4]

Handle

CertoraInc

Vulnerability details

Limbo.sol (stake() function)

if a user has a pending reward and he call the stake function with amount = 0, he won't be able to get his reward (he won't get the reward, and the reward debt will cover the reward)

that's happening because the reward calculation is done only if the staked amount (given as a parameter) is greater than 0, and it updates the reward debt also if the amount is 0, so the reward debt will be updated without the user will be able to get his reward

[gititGoro]

Good catch! I'd be interested in your mitigation step being provided.

To me, it looks like the simplest solution is just to remove that if statement. Users who stake zero will pay unnecessary gas costs but the contract shouldn't have to optimise gas consumption for undesired behaviour.

[jack-the-pug]

Upgraded to Med as users can lose their rewards.