HaxSecurity - Precision loss when calculating rewardData.rate

[sherlock-admin2]

HaxSecurity

Medium

Precision loss when calculating rewardData.rate

Summary

Precision loss when calculating rewardData.rate

Root Cause

In function below precision loss can occur:

https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/StakedEXA.sol#L213

  function notifyRewardAmount(IERC20 reward, uint256 amount, address notifier) internal onlyReward(reward) {
    updateIndex(reward);
    RewardData storage rewardData = rewards[reward];
    if (block.timestamp >= rewardData.finishAt) {
      rewardData.rate = amount / rewardData.duration;
    }

Let's suppose rewardData.duration is 1 week = 604800 seconds. When notifyRewardAmount is called If reward token is WBTC which has 8 decimals, up to 604799 / 1e8 WBTC can be lost (as if the amount was 604799 less). 604799 / 1e8 WBTC = 0.006 WBTC = 400 USD lost to precision loss. This 400 USD then cannot be distributed to stakers.

Internal pre-conditions

WBTC used

External pre-conditions

n/a

Attack Path

n/a

Impact

Precision loss of 400 USDC

PoC

No response

Mitigation

Store the rewardRate scaled by 1e18, so loss of precision will be lower by magnitude of 1e18.

Duplicate of #96