KupiaSec - BribeRewarder has no sweeping mechanism

[sherlock-admin3]

KupiaSec

High

BribeRewarder has no sweeping mechanism

Summary

If nobody votes for a certain pool during an voting peoriod, some bribe reward will be left in the BribeRewarder. However, there is no
sweeping mechanism in the BribeRewarder.

Vulnerability Detail

If nobody votes for a certain pool during an voting peoriod, totalDeposit at L37 is 0. So, bribe rewards for the epoch is not given to anybody.

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/libraries/Rewarder2.sol#L37-L39

37:     function getDebtPerShare(uint256 totalDeposit, uint256 totalRewards) internal pure returns (uint256) {
38:         return totalDeposit == 0 ? 0 : (totalRewards << Constants.ACC_PRECISION_BITS) / totalDeposit;
39:     }

So, the bribe rewards will be left in the BribeRewarder, and they will be frozen, because there is no sweeping mechanism in the BribeRewarder.

Impact

Some Bribe rewards will be frozen in the BribeRewarder.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/libraries/Rewarder2.sol#L37-L39

Tool used

Manual Review

Recommendation

BribeRewarder should have an sweeping function.

Duplicate of #172

[WangSecurity]

Now a duplicate of #172, based on #164 (comment) and #164 (comment) comments.