Usage of lastEligibleStatus can cause user to miss out on rewards on manualStopEmissionsFor invocation

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/reward/ChefIncentivesController.sol#L605-L608

Vulnerability details

Impact

Invoking manualStopEmissionsFor can cause the user to miss out on rewards from vaults even after the user becomes eligible

Proof of Concept

If lastEligibleStatus and isCurrentlyEligible returns true, only the balance of the specific vault is updated. The idea is that whenever both these are true, all the other balances would have already been updated to the current value and hence need not be re-queried again

    function handleActionAfter(address _user, uint256 _balance, uint256 _totalSupply) external {
        if (!validRTokens[msg.sender] && msg.sender != address(mfd)) revert NotRTokenOrMfd();


        if (_user == address(mfd) || eligibilityExempt[_user]) {
            return;
        }
        if (eligibilityMode == EligibilityModes.FULL) {
            bool lastEligibleStatus = eligibleDataProvider.lastEligibleStatus(_user);
            bool isCurrentlyEligible = eligibleDataProvider.refresh(_user);
            if (isCurrentlyEligible) {
                if (lastEligibleStatus) {
                    _handleActionAfterForToken(msg.sender, _user, _balance, _totalSupply);
                } else {
                    _updateRegisteredBalance(_user);
                }
            } else {

But this assumption is broken when manualStopEmissionsFor is called which will set the balance corresponding to each vault as 0

    function manualStopEmissionsFor(address _user, address[] memory _tokens) public isWhitelisted {
        if (_user == address(0)) revert AddressZero();
        uint256 length = _tokens.length;
        for (uint256 i; i < length; ) {
            address token = _tokens[i];
            
            ....

                uint256 newTotalSupply = pool.totalSupply - amount;
                user.amount = 0;
                user.rewardDebt = 0;
                pool.totalSupply = newTotalSupply;


                emit BalanceUpdated(token, _user, 0, newTotalSupply);
            }

Hence in this case, if an user's vault position update makes the user eligible for rewards, only that specific vault associated debt will be earning rewards and all the other vault balances won't be updated

Tools Used

Manual review

Recommended Mitigation Steps

The lastEligibleStatus check can be removed or it can be handled alongside the manualStopEmissionsFor implementation

Assessed type

Other

[c4-judge]

koolexcrypto marked the issue as satisfactory

[c4-judge]

koolexcrypto marked the issue as selected for report