Rewards accrued during totalStaked=0 is lost / unrecoverable

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5298812a129f942555466ebaa6ea9a2af4be0ccc/src/UniStaker.sol#L230

Vulnerability details

Impact

When the totalStaked value is 0, or there are no stakers in the pool, any rewards accrued will be lost. This is demonstrated in this simple scenario:

1. Say there are currently no stakers. A user has called notifyRewardAmount with 30 WETH.
2. scaledRewardRate is set to 30 WETH / 30 days = 1 WETH/day
3. After 15 days, a user stakes to the pool. lastCheckpointTime is updated to block.timestamp.
4. After the full 30 days, the user can claim 1 WETH/day * (15 days) = 15 WETH reward. The remaining 15 WETH is stuck in the contract and cannot be recovered.

This will lead to unrecoverable WETH in the contract.

Proof of Concept

Any rewards accrued during a period of no stakers cannot be recovered.

Tools Used

Manual Review

Recommended Mitigation Steps

Add a recoverWETH admin controlled function which will allow recovering any WETH in the pool provided that the contract still remains solvent.

Assessed type

Token-Transfer

[c4-judge]

MarioPoneder marked the issue as duplicate of #9

[c4-judge]

MarioPoneder marked the issue as duplicate of #369

[c4-judge]

MarioPoneder marked the issue as unsatisfactory:
Invalid