[audit] 2. Incorrect reward distribution due to inconsistent voting power queries

[NoahSaso]

From Oak:

In contracts/distribution/dao-rewards-distributor/src/rewards.rs:113-136, the get_active_total_earned_puvp function computes the reward index by dividing the accrued rewards with total voting power queried from the previous block height (see contracts/distribution/dao-rewards-distributor/src/helpers.rs:19). This is incorrect because the user reward is computed with voting power queried from the current block height, as seen in contracts/distribution/dao-rewards-distributor/src/helpers.rs:33.

Consequently, the reward index will be computed using an outdated total voting power, resulting in incorrect reward distribution. An attacker can exploit this issue by staking many tokens one block before claiming the rewards to receive more at the expense of other users.

This fix ensures that the total voting power from the same height as the member's voting powers is used.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.64%. Comparing base (2cac217) to head (b7b1ac3).

Additional details and impacted files

@@             Coverage Diff              @@
##           development     #863   +/-   ##
============================================
  Coverage        96.64%   96.64%           
============================================
  Files              241      241           
  Lines            65432    65464   +32     
============================================
+ Hits             63234    63266   +32     
  Misses            2198     2198           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bekauz]

nice!