FeeSplitter.onBalanceChange doesn't claim already earned fees

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-curves/blob/main/contracts/FeeSplitter.sol#L96-L100

Vulnerability details

Proof of Concept

Subject token holders receive some portion of fees from subject token trading.
First, user's data.userFeeOffset[account] is updated to current reward rate of token. And then fee is distributed among all subject token holders and reward rate is increased.

The problem is that when onBalanceChange is called, then function doesn't account situation, when user's balance was not 0 before and that he already accrued some fee. In this case they are not claimed and userFeeOffset is updated, which means that user has lost that portion of fees.

Impact

User loses part of fee.

Tools Used

VsCode

Recommended Mitigation Steps

Make sure that all earned fees are accumulated and then update the rate.

Assessed type

Error

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #39

[c4-judge]

alcueca marked the issue as satisfactory

[c4-judge]

alcueca changed the severity to 3 (High Risk)