CompoundingRewardsPoolFactory Manual Review Findings

CRF-01M: Schedule & Reward Desynchronization

Description:

The previous iteration of the codebase transferred sufficient funds for the reward schedule the contract supported whereas the new implementation does not guarantee funds will be available for the schedule.

Example:

Copy
78CompoundingRewardsPool rewardsPool = new CompoundingRewardsPool(
79        IERC20Detailed(_stakingToken),
80        _startBlock,
81        _endBlock,
82        rewardTokens,
83        rewardsPerBlock,
84        uint256(-1),
85        address(autoStaker),
86        externalRewardToken,
87        _contractStakeLimit,
88        _initialAmountToTransfer
89    );
90
91autoStaker.setPool(address(rewardsPool));
92
93IERC20Detailed(_stakingToken).safeTransfer(address(rewardsPool), _initialAmountToTransfer);

Recommendation:

We advise the code to be reverted to the previous iteration as in the current one there is no guarantee sufficient funds will be available to make payouts, halting a lot of the functions exposed by the contract.

Alleviation:

The Alliance Block team stated that this is indeed intended and that they will be manually responsible for ensuring sufficient tokens are within the campaign to pay rewards. As a result, we consider this exhibit null.