stake() needs to be pausable for completed incentives and two bug fixes.
Enhancements include:
\nPausable contract and add notPaused modifer to stake() to prevent staking into deprecated poolssetRewardsDuration to allow rewardsDuration to be updated after the initial settingWhen a StakingRewards campaign has completed the contract needs to prevent anyone from staking into it. The staker will not accrue any rewards and can cause blocking issues with inverse Synths that need to be purged so that they can be relanced.\nAdding Pausable.sol and modifier notPaused to stake() will allow the admin to set paused to true preventing anyone from staking. SelfDestructible has not been implemented and given the amount of value in these contracts probably best not to implement.
There is a multiplication overflow that can occur inside the rewardPerToken function, on line 66:
\nlastTimeRewardApplicable().sub(lastUpdateTime).mul(rewardRate).mul(1e18).div(_totalSupply)\nAn overflow occurs whenever rewardRate >= 2^256 / (10^18 * (lastTimeRewardApplicable() - lastUpdateTime)).
This can happen when the updateReward modifier is invoked, which will cause the following functions to revert:
\nearnedstakewithdrawgetRewardexitnotifyRewardAmountThe reward rate is set inside notifyRewardAmount, if a value that is too large is provided to the function.\nOf particular note is that notifyRewardAmount is itself affected by this problem, which means that if the provided\nreward is incorrect, then the problem is unrecoverable.
The notifyRewardAmount transaction should be reverted if a value greater than 2^256 / 10^18 is provided.\nAs an additional safety mechanism, this value will be required to be no greater than the remaining\nbalance of the rewards token in the contract. This will both prevent the overflow, and also provide an additional check\nthat the reward rate is being set to a value in the appropriate range (for example, no extra/missing zeroes).
Specifically, this problem occurs when rewardRate is too high; it is set inside the notifyRewardAmount function on\nlines 114 and 118.
rewardRate = floor(reward / rewardsDuration) = (reward - k) / rewardsDuration\nfor some 0 <= k < rewardsDuration.
For the bug to occur, we need:
\n(reward - k) / rewardsDuration >= 2^256 / (10^18 * (lastTimeRewardApplicable - lastUpdateTime))\nreward >= rewardsDuration * 2^256 / (10^18 * (lastTimeRewardApplicable - lastUpdateTime)) + k\nHence, we can ensure the bug does not occur if we force:
\nreward < rewardsDuration * 2^256 / (10^18 * (lastTimeRewardApplicable - lastUpdateTime))\nSo we should constrain reward to be less than the minimum value of the RHS.
The smallest possible value of lastUpdateTime is the block timestamp when notifyRewardAmount was last called.\nThe largest possible value of lastTimeRewardApplicable is periodFinish,\nand periodFinish = notificationBlock.timestamp + rewardsDuration (line 121).\nPutting these together we have:
(lastTimeRewardApplicable - lastUpdateTime) <= rewardsDuration\nErgo, we need:
\nreward < rewardsDuration * 2^256 / (10^18 * rewardsDuration)\n\t = 2^256 / 10^18\nSo the problem will not emerge whenever we require
\n reward < uint(-1) / UNIT\nsetRewardsDuration was intended to allow the rewardsDuration to be set after the duration had completed. However a flaw in the require meant it could be changed after the initial setting.
Current code
\nrequire(periodFinish == 0 || block.timestamp > periodFinish);\nProposed change
\nrequire(block.timestamp > periodFinish);\nPausable.sol contract and add modifier notPaused to stake()notifyRewardAmount transaction if the computer reward rate would pay out more than the balance of the contract over the reward period.require in setRewardsDuration to only check the period has finishednotifyRewardAmount if reward is greater than the contract balancenotifyRewardAmount if reward plus any leftover from the previous period is greater than the contract balancenotifyRewardAmount if reward is equal to the contract balancePlease list all values configurable via SCCP under this implementation.
\nCopyright and related rights waived via CC0.
"}},"pageContext":{"id":"5cb353ea-5892-5de1-9e13-cfee30bddd7e","frontmatter__sip":77,"__params":{"frontmatter__sip":"77"}}},"staticQueryHashes":[]}