M-27 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

Comments

In the original implementation, when a claimer bot claims prizes for winners the fee per claim is calculated based on the tier being claimed for, the number of tiers, the number of claims being made by the bot and the total claim count for the prize pool in the current claim period. However the previous implementation did not consider the claim count of canary prizes which is tracked separately to the claim count for normal prize tiers, resulting in the fee amount being higher than intended.

Mitigation

The updated implementation does not distinguish between canary prize tier claims and normal prize tier claims. Therefore the fee per claim is now calculated based on the total number of prizes that have been claimed from the prize pool in the current claim period from all the tiers. Also, the number of prizes for the canary tier is now based on the prize count of the next highest tier and the prize size is scaled accordingly (vs the reverse in the previous implementation). The result is that the fee per claim is now consistent across claims of all tiers, and since claimers are now incentivised to claim lower tiers (i.e. higher prizes) first, fees can't really be manipulated and the original issue is resolved.

Conclusion

LGTM

[c4-judge]

Picodes marked the issue as satisfactory