roguereddwarf - Carousel: emission tokens are lost if epoch has no deposits (NULL epoch)

[sherlock-admin]

roguereddwarf

medium

Carousel: emission tokens are lost if epoch has no deposits (NULL epoch)

Summary

The CarouselFactory allows the creation of epochs with emissions using the CarouselFactory.createEpochWithEmissions function.

The emission tokens are transferred into both Vaults and can be withdrawn by users after the epoch has ended based on the number of shares a user holds.

The purpose of the emissions is to entice users to make deposits.

The issue is that the epoch can be a NULL epoch, i.e. there are no user deposits.

In this case the emission tokens will be lost. If the epoch is a NULL epoch it should be possible to withdraw the emissions so they can be used to emit them in a later epoch.

Vulnerability Detail

An epoch with emissions is created using the CarouselFactory.createEpochWithEmissions function:
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/CarouselFactory.sol#L132-L153

Users can withdraw the emissions after the epoch has ended. And the amount they receive is calculated using the Carousel.previewEmissionsWithdraw function:
https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L630-L636

If no deposits have been made to the Vault (which is known as a NULL epoch) the emissions cannot be withdrawn by anyone and they will be lost.

So there needs to be some way for the protocol to rescue the emission tokens such that they can be used in a later epoch.

Impact

The emissions are lost when there are no deposits for an epoch.
This is a direct loss of funds for the protocol.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/CarouselFactory.sol#L132-L153

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L630-L636

Tool used

Manual Review

Recommendation

The Carousel contract needs to implement a function that can be called by the owner role or the timelocker role that can rescue the emission tokens for an epoch if the epoch is resolved and there were no deposits.

It can be checked if there were no deposits by checking if finalTVL[_id]==0.

Duplicate of #122