091.md

Blurry Mauve Jay

Medium

setting Cliff durations to a value not a multiple of one month would force user to wait extra time before they can claim

Summary

There is no check to ensure that the cliff duration of an address is a multiple, https://github.com/sherlock-audit/2024-10-usual-labs-v1/blob/main/pegasus/packages/solidity/src/token/UsualSP.sol#L327-L364 this means that assuming a user cliff duration is one month and 3 weeks, they would have to wait for 3 weeks extra in which they would not accrue any rewards and would still only be able to claim the rewards for that complete month

https://github.com/sherlock-audit/2024-10-usual-labs-v1/blob/main/pegasus/packages/solidity/src/token/UsualSP.sol#L196-L201

as can be seen above, the address would have to wait for the entire cliff duration, however bacause the extra period is not up to a month, it would round down this means that for some period of time during the user duration. they are not accruing rewards

Root Cause

missing check in allocate

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

user would have delay in completing their reward cycle

PoC

No response

Mitigation

a check in allocation to ensure that the cliffDuration is a multiple of 1 month