Lack of NFT ownership check on closePosition enables boost market exploitation

The StakingContract only checks NFT ownership at stake time and permanently stores the boosted rewards in the position struct. This allows for the creation of NFT rental markets specifically designed to exploit the boost mechanism:

// NFT check only happens once at stake time
if (isNftHolder(msg.sender)) {
    boostedInterest = (baseInterest * rewardBoostMultiplier) / 100;
}

// Boosted rewards are permanently stored
positions[currentPositionId] = Position({
    tokensInterest: boostedInterest,  // Locked at stake time
    // ...
});

// No NFT verification at withdrawal
function closePosition(uint positionId) external nonReentrant {
    uint totalTokens = position.tokensStaked + position.tokensInterest;
    stakingToken.safeTransfer(msg.sender, totalTokens);
}

This design enables the creation of centralised "boost-as-a-service" markets where:

• NFT holders can rent out their NFTs for brief moments.
• Stakers can rent NFTs just for the staking transaction.
• Multiple stakers can use the same NFT to get boosted rewards.

The vulnerability undermines the entire NFT boost mechanism:

1. Protocol loses ability to reward genuine long-term NFT holders.
2. Single NFT can be used to boost multiple positions.
3. Creates a secondary market that commoditises the boost feature.
4. Economic impact equals (boostedInterest - baseInterest) for each exploited position.

During mitigation period, an improved approach was identified for handling NFT boosts. Store both the base and boosted reward values in the Position struct, along with tracking the initial NFT ownership status, then determine the final reward at close based on whether the staker still holds the NFT.

struct Position {
    address walletAddress;
    uint createdDate;
    uint unlockDate;
    uint lockedDays;
    uint baseReward;       // Store base reward
    uint finalReward;      // Store boosted reward if applicable
    bool initialNftHolder; // Track if user had NFT when staking
    uint tokensStaked;
    bool open;
}

In closePosition, use stored values with conditional logic:

uint finalReward = (isNftHolder(msg.sender) && pos.initialNftHolder)
    ? pos.finalReward
    : pos.baseReward;

This implementation ensures users who had NFTs when staking and still have them at withdrawal get the boosted reward; users who had NFTs when staking but no longer have them get the base reward; users who did not have NFTs when staking but acquired them later do not get retroactively boosted.

Ample Protocol: Fixed.

Zealynx: The team implemented the recommendation to track NFT ownership; an additional optimisation was identified during verification and the recommendation was updated. Suggestion implemented and verified.