mediumLogic errorEVM-Solidity
Symmio, Staking and Vesting: Malicious User can dilute staking Rewards to a longer timeframe
- Payout
- $0
- Protocol
- Symmio, Staking and Vesting
- Disclosed
- Mar 10, 2025
- Source
- sherlock
Symmio's SymmStaking contract lets anyone call notifyRewardAmount to deposit rewards. Because the reward rate is recomputed as (amount + leftover)/fixed period whenever new rewards arrive during an active period, a malicious actor can repeatedly top up a tiny …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.