highLogic errorEVM-Solidity
Zivoe: Anyone could call `depositReward` with zero reward to extend the period finish time
- Payout
- $0
- Protocol
- Zivoe
- Disclosed
- Apr 25, 2024
- Source
- sherlock
Zivoe's permissionless ZivoeRewards.depositReward let any address push a zero-amount deposit, which still rewrites rewardRate downward and resets periodFinish to now + rewardsDuration. An attacker could repeatedly extend the reward window at no cost, stretchin …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.