MrCrowNFT - [M-1] Bribe

[sherlock-admin3]

MrCrowNFT

Medium

[M-1] Bribe

Summary

Vulnerability Detail

Any user can create a bribe rewarder for any pool using RewardFactory.sol::createBribeRewarder, and in order to register the rewarder in Voter.sol, it requires that the rewarder has enough balance to cover the rewards, but the reward is set by the owner/creator of the rewarder. Furthermore, Voter.sol::onRegister has max amount of rewarders that a certain pool can have (5). Therefor a user can do the following:

1. Create 5 Bribe Rewarders with a target pool as beneficiary.
2. Use fundAndBribe with a minimum amount on each to register them.
3. Now the target pool can not register more rewarders and there is barely any incentive for voting for said pool.

For example, the following code tests registering a rewarder with an amount of 20 from an ERC20 with 18 decimals, meaning its the equivalent of having a 20 WEI reward, you may add it to BribeRewarder.t.sol for testing.

function testBribeRewarderWithLowFunds() public {
        ERC20Mock(address(rewardToken)).mint(address(this), 20);
        ERC20Mock(address(rewardToken)).approve(address(rewarder), 20);
        rewarder.fundAndBribe(1, 2, 10);

        _voterMock.setCurrentPeriod(1);
        _voterMock.setStartAndEndTime(0, 100);

        vm.warp(0);
        vm.prank(address(_voterMock));
        rewarder.deposit(1, 1, 0.2e18);
        vm.stopPrank();
    }

Meaning that it would cost anyone <1USD to sabotage the reward system of any pool (not accounting for gas) making this scenario very likely.

Impact

This could potentially lead to unfair competition and sabotage during the voting periods.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/rewarders/RewarderFactory.sol#L109-L113
https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/rewarders/BribeRewarder.sol#L226-L258
https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/Voter.sol#L130-L144

Tool used

Manual Review

Recommendation

1. Add a min amount of reward require to register a rewarder.
2. Limit who can create the bribe rewarders to pool owners or trusted addresses.

Duplicate of #190