Honour - unclaimable rewards in UsualSP under certain conditions

[sherlock-admin2]

Honour

Medium

unclaimable rewards in UsualSP under certain conditions

Summary

Removing allocations and re-allocating after the initial staking has started will result in unclaimable rewards that will be stuck in the UsualSP contract.

Root Cause

To understand the issue here we need to first understand the initial staking and allocation process.

1. The total supply of UsualS to be staked is minted on the contract initialization.
2. The users allocations are calculated offchain and then allocated via the allocate function.
3. The staking is started by calling the stakeUsualS function
   Note the order of allocating and staking (i.e 2 & 3) is not mentioned in the documentation, this is the order that makes the most sense because staking before allocating will lead to unfair reward distribution.

Will the protocol need to remove allocations and re-allocate after initial staking?

There is reason to believe that this is an expected functionality that the protocol has accounted for, the code strongly suggests that this is the case.

1. the removeOriginalAllocations function also removes the originalClaimed - this suggests that the function is expected to be called after the staking and possibly even after the user must have previously claimed some of their original allocations.
2. the allocate function updates reward before changing the users allocation. This also suggests that the function is expected to be called after the staking has began as there'll be no need for this before staking because totalStaked() will be 0 and the reward accrued will always be 0.

The issue here lies in removing allocations or re-allocating after the initial staking (stakeUsualS).
The removeOriginalAllocations function does not update user rewards and because the totalStaked is remains the same the removed allocation still accrues rewards but these rewards are not claimable. Even if the allocation is re-allocated via allocate , the allocate function updates the rewards before changing the allocation.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Medium - unclaimable rewards will be stuck in the contract

PoC

No response

Mitigation

Add updateRewards to the removeOriginalAllocations function so the rewards generated by the removed allocation can still be claimed by the user