SurplusGuildMinter users continue to accrue claimable rewards when they should be slashed

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L216

Vulnerability details

Impact

SurplusGuildMinter.getRewards claims and distributes rewards to users before slashing them if they ought to be slashed. As a result, users can wait and allow the rewards to accrue then later claim rewards before being slashed.

Proof of Concept

When a gauge loss occurs, all the stakers for that gauge in SurplusGuildMinter can be slashed. However, the slashing doesn't actually occur until getRewards is called for that user and term. Additionally, any unclaimed rewards will be claimed before the user is slashed.

As a result, if a gauge loss occurs, users can simply not call getRewards, and if the term is later re-onboarded, they will continue to accrue rewards on their position, even though they should have been slashed.

Tools Used

• Manual review

Recommended Mitigation Steps

An incentive mechanism should be incorporated to slash users. A simple solution would be to add a fee which is rewarded to getRewards callers when the account is slashed.

Assessed type

Other

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #956

[c4-judge]

Trumpero marked the issue as duplicate of #262

[c4-judge]

Trumpero changed the severity to QA (Quality Assurance)

[c4-judge]

Trumpero marked the issue as grade-b

[c4-judge]

Trumpero marked the issue as grade-c