Lambda - Comptroller.withdrawRewards: totalFrozen subtracted two times from totalStaked

[sherlock-admin]

Lambda

medium

Comptroller.withdrawRewards: totalFrozen subtracted two times from totalStaked

Summary

In Comptroller.withdrawRewards, userManagerState.totalFrozen is subtracted two times from totalStaked, leading to a wrong inflation index or even a broken system because the calculation underflows.

Vulnerability Detail

_getUserManagerState calculates the totalStaked like this:

        userManagerState.totalFrozen = userManager.totalFrozen();
        userManagerState.totalStaked = userManager.totalStaked() - userManagerState.totalFrozen;

totalStaked is therefore already set to totalStaked - totalFrozen. However, in withdrawRewards, the following calculation is performed:

uint256 totalStaked_ = userManagerState.totalStaked - userManagerState.totalFrozen;

totalFrozen is therefore subtracted from totalStaked again, meaning we have:

totalStaked_ = userManager.totalStaked() - userManagerState.totalFrozen() - userManagerState.totalFrozen()

Impact

When userManagerState.totalFrozen() is sufficiently large, this can lead to an underflow, meaning that withdrawRewards (and therefore UserManager.stake, UserManager.unstake, and UserManager.withdrawRewards) can never be executed, which bricks the system. But even if it does not underflow, the following update of gInflationIndex will use a wrong value.

Code Snippet

https://github.com/sherlock-audit/2022-10-union-finance/blob/main/union-v2-contracts/contracts/token/Comptroller.sol#L260

Tool used

Manual Review

Recommendation

Do not subtract totalFrozen a second time.

duplicate of #26