neogranicen - User will lose all his secondary rewards if the extra rewarder gets updated while he is staking

[sherlock-admin3]

neogranicen

Medium

User will lose all his secondary rewards if the extra rewarder gets updated while he is staking

Summary

If a user stakes tokens in the masterchefV2 and the Extra Rewarder gets changed while the user tokens are staked he will loose all his rewards from the previous rewarder

Vulnerability Detail

A users rewards from the masterchef rewarder are sent to him everytime he: deposits,withrawls,claim rewards or the trustee deposits for him and this is done by calling onModify

• Now alice deposits 100 tokens
• Now non of the actions decribed above the causes onModify to be called on here account happen
• After 10 days at a rate of 1 reward token per day for 1 deposited token she has 1000 reward tokens.
• Before alice claims the rewards _setExtraRewarder is called and the extra rewarder is changed
• now alice calls claim but recieves nothing

Impact

The issue outlined above will cause loss of funds to users who did not get their rewards yet and the damage will depend on how frequently the rewarder is updated

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/42e799446595c542eff9519353d3becc50cdba63/magicsea-staking/src/MasterchefV2.sol#L488

Tool used

Manual Analysis

Recommendation

Ensure that all the rewards from the old extra rewarder are distrubuted before setting a new one

[WangSecurity]

Invalid based on the discussion under #460