Reward Index Inflation Due to Rounding Up Can Trap Rewards

Impact: Medium

Likelihood: Medium

In the _depositPremium function within PositionInteractionFacet.sol, when option premiums are added as rewards for liquidity providers, the rewards.rewardsPerLPQ128 index is updated using mulDivRoundingUp:

if (lpSupply > 0) rewards.rewardsPerLPQ128 += upscaledPremium.mulDivRoundingUp(Q128, lpSupply);

Using mulDivRoundingUp causes the calculated reward added per LP token unit (scaled by Q128) to be rounded up to the nearest integer in the fixed-point representation. While seemingly small for individual deposits, these upward rounding errors accumulate in the rewardsPerLPQ128 index with each premium deposit over time.

This leads to the rewardsPerLPQ128 index potentially representing a slightly higher total reward distribution promise than the actual amount of totalRewards physically deposited into the pool.

When a user claims rewards via _claimRewards in LiquidityFacet.sol, their pending rewards (pending) are calculated based on the difference in the (potentially inflated) index relative to their last claim checkpoint. The function then attempts to subtract these pending rewards from the actual totalRewards available:

strg.ledger.state.rewardsByToken[token].totalRewards -= pending;

If the accumulated upward rounding errors in the rewardsPerLPQ128 index cause the calculated pending amount for a user (especially one claiming later after many premium deposits have occurred) to exceed the actual remaining totalRewards, this subtraction will underflow and revert the transaction.

Consequently, the last users attempting to claim their rewards may be unable to do so, and their legitimately earned rewards become permanently trapped in the contract.

To prevent reward index inflation and ensure accounting solvency, use standard rounding down when calculating the reward-per-token index increment.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.