pashap9990 - ‌Bribe givers cannot sweep their residual assets

[sherlock-admin4]

pashap9990

Medium

‌Bribe givers cannot sweep their residual assets

Summary

‌Bribe givers deposit assets into BribeRewarder to make some pools attractive for voters but in some cases its possible anyone don't vote to that pool hence assets of ‌bribe givers will be locked in BribeRewarder for ever and
based on docs

Bribes as an additional incentive to vote can be claimed 24-48 hours after an epoch has ended. Voters can claim the rewards until the next epoch is ended. Unclaimed rewards will be sent back to the briber

Vulnerability Detail

any rewarder extended from BaseRewarder they have sweep function for repay left over assets to rewarder's owner but because BribeRewarder doesn't extend from BaseRewarder hence that hasn't any functionality for sweep residual assets

Impact

there is no way for repay leftover assets to bribe giver

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/rewarders/BribeRewarder.sol#L31

Tool used

Manual Review

Recommendation

Its better to add sweep function to BribeRewarder

Duplicate of #172

[WangSecurity]

Now a duplicate of #172, based on #164 (comment) and #164 (comment) comments.