In case when not all RSR was sold on auction users can loose it

[code423n4]

Lines of code

https://github.com/reserve-protocol/protocol/blob/c4ec2473bbcb4831d62af55d275368e73e16b984/contracts/p1/StRSR.sol#L416-L469
https://github.com/reserve-protocol/protocol/blob/c4ec2473bbcb4831d62af55d275368e73e16b984/contracts/p1/BackingManager.sol#L149-L152
https://github.com/reserve-protocol/protocol/blob/c4ec2473bbcb4831d62af55d275368e73e16b984/contracts/p1/BackingManager.sol#L205-L208

Vulnerability details

Impact

In case when not all RSR was sold on auction users can loose it, if era was changed for them.

Proof of Concept

The purpose of StRSR stakers is to provide RSR tokens, that can back system in case if not enough collateral is present. During rebalance, BackingManager can seize funds from StRSR.
It's possible that the sum that is needed will make new era begin, which means that user don't have any stRSR anymore.

But also it's possible that not all amount of RSR will be traded by Gnosis auction, so as result BackingManager will contain RSR, that will be returned back to StRSR.

The problem is that this amount will not be returned to the stakers who were seized, it will be returned to another era stakers. As result old era stakers lost their funds, while new era stakers received more funds.

Tools Used

VsCode

Recommended Mitigation Steps

Maybe it's possible to track era that was seized in order to return funds to the stakers of that era, so they can claim them according to their StRSR or drafts in that era.

Assessed type

Error

[0xean]

related to #2

[tbrent]

I believe this is a dup of a previous finding: code-423n4/2023-02-reserve-mitigation-contest-findings#17

[c4-sponsor]

tbrent marked the issue as sponsor disputed

[rvierdiiev]

No, this issue is not same as previous finding. The difference is that previous finding talks this happen, when era didn't changed so returned amount is distributed among previous stakers and new stakers.
While this issue is talking about when new era is started and previous stakers don't receive funds back at all.

[tbrent]

You can see in code-423n4/2023-02-reserve-mitigation-contest-findings#17 that it was listed as a dup of code-423n4/2023-02-reserve-mitigation-contest-findings#48, where 48 is specifically about a new era.

[c4-judge]

0xean marked the issue as unsatisfactory:
Out of scope