Ace-30 - [Carousel] After some time the mintRollovers wont be cost effective for minters

[sherlock-admin]

Ace-30

medium

[Carousel] After some time the mintRollovers wont be cost effective for minters

Summary

1. rolloverQueue grows in time: for many reasons:
   A: at each epoch, all users may lose money and most of them never return. these items remain in rolloverQueue forever because no one else can delist them.
   B: An attacker can do this multiple times : from a new account, deposit minRequired amount to epoch 0, and enlist in rollover which cant be minted and remains in rolloverQueue forever

2. mintRollover starts from the beginning of the queue for each new epoch and skip items that assets<relayerFee:

// mint only if user won epoch he is rolling over
if (entitledShares > queue[index].assets) {
    // skip the rollover for the user if the assets cannot cover the relayer fee instead of revert.
    if (queue[index].assets < relayerFee) {
        index++;
        continue;
     }
}

So for each new epoch, minters try to mint all items of rolloverQueue but most of them are not mintable and they get nothing

Vulnerability Detail

Impact

The rolloverQueu grows in time and mintRollovers won't be cost-effective for minters

Code Snippet

https://github.com/Y2K-Finance/Earthquake/blob/736b2e1e51bef6daa6a5ecd1decb7d156316d795/src/v2/Carousel/Carousel.sol#L400-L406

Tool used

Manual Review

Recommendation

In mintRollovers function, delist items that are not mintable anymore:
Use this code:

if (entitledShares < queue[index].assets || queue[index].assets < relayerFee ) {
    _delistInRollover(queue[index].receiver);  //internal function for delisting users
    continue;  //continue with the same index because it is replaced...
}

instead of this:

// mint only if user won epoch he is rolling over
                if (entitledShares > queue[index].assets) {
                    // skip the rollover for the user if the assets cannot cover the relayer fee instead of revert.
                    if (queue[index].assets < relayerFee) {
                        index++;
                        continue;
                    }

Duplicate of #172