Users can grief reward distribution

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/ExtraRewardsDistributor.sol#L74

Vulnerability details

Impact

Users can grief reward distributions by spending dust

Proof of Concept

If a reward is targeted for an epoch in the past, a user can front-run the txn in the mempool and call addRewardToEpoch() with a dust amount at an epoch after the one in question. This will cause the transaction in the mempool to revert

File: contracts/ExtraRewardsDistributor.sol   #1

74               require(len == 0 || rewardEpochs[_token][len - 1] < _epoch, "Cannot backdate to this epoch");

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/ExtraRewardsDistributor.sol#L74

Tools Used

Code inspection

Recommended Mitigation Steps

Allow the backdating of rewards, which will cost more gas

[0xMaharishi]

Fair finding, however since this is a peripheral contract and only affects user reward claiming. In the Aura system, rewards are only added to the current epoch so should be fine