Stream.claimReward can be simplified

[code423n4]

Handle

hyh

Vulnerability details

Impact

Gas is overspent on storage access and operations.

Proof of Concept

claimReward function has some excess operations and the number of times it reads storage can be reduced:
https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol#L555

Recommended Mitigation Steps

Save repeatedly accessed storage variables to memory and use them, simplify the logic:

Now:

...
cumulativeRewardPerToken = rewardPerToken();

// update user rewards
ts.rewards = earned(ts, cumulativeRewardPerToken);
// update users last cumulative reward per token
ts.lastCumulativeRewardPerToken = cumulativeRewardPerToken;

lastUpdate = lastApplicableTime();

uint256 rewardAmt = ts.rewards;
ts.rewards = 0;

require(rewardAmt > 0, "amt");

// transfer the tokens
ERC20(rewardToken).safeTransfer(msg.sender, rewardAmt);
...

To be:

...
uint256 _cumulativeRewardPerToken = rewardPerToken();

uint256 rewardAmt = earned(ts, _cumulativeRewardPerToken);
require(rewardAmt > 0, "amt");

cumulativeRewardPerToken = _cumulativeRewardPerToken;
lastUpdate = lastApplicableTime();

// update users last cumulative reward per token and rewards
ts.lastCumulativeRewardPerToken = _cumulativeRewardPerToken;
ts.rewards = 0;

// transfer the tokens
ERC20(rewardToken).safeTransfer(msg.sender, rewardAmt);
...