totalDeclaredReward >= totalReleasedReward not true in AbstractRewardMine

[code423n4]

Handle

cmichel

Vulnerability details

The AbstractRewardMine contract states the following about the two variables:

totalReleasedReward and totalDeclaredReward will often be the same. However, in the case of vesting rewards they are different. In that case totalDeclaredReward is total reward, including unvested. totalReleasedReward is just the rewards that have completed the vesting schedule.

According to the description, it should be the case that totalDeclaredReward >= totalReleasedReward at all times.
But it's not true as totalReleasedReward = totalDeclaredReward + _globalWithdrawn >= totalDeclaredReward.

Recommended Mitigation Steps

I don't think the implementation in the abstract contract makes sense, the derived contracts all correctly overwrite it.
Maybe it should be a virtual function without an implementation that needs to be overridden.

[0xScotch]

The AbstractRewardMine implementation is indeed incorrect. The solution is to add + _globalWithdrawn to the totalDeclaredReward method.

As stated in the issue above, the 2 places that inherit this contract correctly override the methods in question.

[GalloDaSballo]

Will mark the finding valid as the logic detailed was incorrect, as for the inheritance discussion, probably best left for a different issue