KupiaSec - Unclaimed rewards from the emergencyWithdraw() function remain permanently locked in the MlumStaking contract

[sherlock-admin3]

KupiaSec

High

Unclaimed rewards from the emergencyWithdraw() function remain permanently locked in the MlumStaking contract

Summary

When using the emergencyWithdraw() function, rewards are not sent to the user, and the unclaimed rewards become permanently locked in the MlumStaking contract.

Vulnerability Detail

When the emergencyWithdraw() function is called, the harvest process is skipped, so any accumulated rewards are not sent to the user. Additionally, there is no mechanism to release the user's unclaimed rewards. As a result, those rewards become permanently locked in the MlumStaking contract, as there is no sweep function to retrieve them.

    function emergencyWithdraw(uint256 tokenId) external override nonReentrant {
        _requireOnlyOwnerOf(tokenId);

        StakingPosition storage position = _stakingPositions[tokenId];

        // position should be unlocked
        require(
            _unlockOperators.contains(msg.sender)
                || (position.startLockTime + position.lockDuration) <= _currentBlockTimestamp() || isUnlocked(),
            "locked"
        );
        // emergencyWithdraw: locked

        uint256 amount = position.amount;

        // update total lp supply
        _stakedSupply = _stakedSupply - amount;
        _stakedSupplyWithMultiplier = _stakedSupplyWithMultiplier - position.amountWithMultiplier;

        // destroy position (ignore boost points)
        _destroyPosition(tokenId);

        emit EmergencyWithdraw(tokenId, amount);
        stakedToken.safeTransfer(msg.sender, amount);
    }

Impact

Rewards not claimed during the emergencyWithdraw() function become permanently locked in the MlumStaking contract.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L536-L560

Tool used

Manual Review

Recommendation

It is recommended to either:

1. Release the unclaimed rewards in the emergencyWithdraw() function by subtracting the unclaimed amount from _lastRewardBalance.

+       _lastRewardBalance -= unclaimedRewards; // unclaimedRewards should be calculated

2. Implement a separate sweep function to retrieve the unclaimed rewards.

Duplicate of #460