User adds a reward value that causes rate to round down to zero

Oct 13, 2025 by talynt.org 128 views

Virtual Heather Guppy - Reward Rate Rounding to Zero in SymmStaking Contract causes loss of rewards for users

Introduction

The SymmStaking contract, a crucial component of the Symm.io protocol, has been found to be vulnerable to a rounding issue that can cause the reward rate to be set to zero. This vulnerability can lead to a significant loss of rewards for users, undermining trust in the staking mechanism and potentially causing mass unstaking. In this article, we will delve into the root cause of the issue, the attack path, and the impact of the vulnerability. We will also provide a proof-of-concept (PoC) and a mitigation strategy to address the problem.

Summary

The _addRewardsForToken function in the SymmStaking contract is vulnerable to a rounding issue where the reward rate can be set to zero due to integer division. This occurs when the reward amount is less than the duration period, causing the division to round down to zero. Once the rate is set to zero, rewards effectively stop accruing for users, breaking core contract functionality.

Root Cause

The vulnerability stems from Solidity's integer division behavior, which truncates decimal results. In the _addRewardsForToken function, the reward rate is calculated by dividing the reward amount by the duration:

state.rate = amount / state.duration;

or in the case of an ongoing reward period:

state.rate = (amount + leftover) / state.duration;

If amount (or amount + leftover) is less than state.duration, the division will result in zero, effectively stopping reward distribution.

Internal Pre-conditions

The contract uses integer division to calculate reward rates No minimum check is implemented for reward amounts The state.duration value is sufficiently large (e.g., measured in seconds for a week or month)

External Pre-conditions

User adds a reward value that causes rate to round down to zero

Attack Path

There are two main scenarios where this vulnerability can be exploited: Initial reward setup:
- An attacker or mistaken admin adds a reward amount that is less than the duration
- Example: If duration is 604,800 (1 week in seconds) and amount is 604,000 tokens
- Result: state.rate = 604,000 / 604,800 = 0 due to integer division
Subsequent reward additions:
- For an ongoing reward period, if amount + leftover is less than state.duration
- Example: If there are 100,000 tokens leftover, duration is 604,800, and a new amount of 504,700 is added
- Result: state.rate = (504,700 + 100,000) / 604,800 = 604,700 / 604,800 = 0
- Once the rate is set to zero, all stakers will stop receiving rewards until a new, sufficiently large reward amount is added.

Impact

Stakers receive no rewards despite tokens being added to the contract
Loss of funds for the protocol as rewards are effectively locked
Undermines trust in the staking mechanism
May lead to mass unstaking if users notice they aren't receiving rewards

PoC

it.only("Reward rate rounds down to ZeroPOC", async function () {
			// Give user2 some USDT
			await usdtToken.connect(admin).transfer(user2.address, 604800)

			const depositAmount = "604800" // user1 deposits 604,800 SYMM
			const rewardAmount = "604800" // Total reward for 7 days

			// user1 deposits tokens
			await stakingToken.connect(user1).approve(await symmStaking.getAddress(), depositAmount)
			await symmStaking.connect(user1).deposit(depositAmount, user1.address)

			// Admin configures and notifies rewards
			await usdtToken.connect(admin).approve(await symmStaking.getAddress(), rewardAmount)
			await symmStaking.connect(admin).configureRewardToken(await usdtToken.getAddress(), true)
			await symmStaking.connect(admin).notifyRewardAmount([await usdtToken.getAddress()], [rewardAmount])

			// Fast forward time to accumulate some rewards
			await time.increase(302400)

			// More rewards added to incentivise staking
			await usdtToken.connect(admin).approve(await symmStaking.getAddress(), 302400)
			await symmStaking.connect(admin).notifyRewardAmount([await usdtToken.getAddress()], [302400])

			// Fast forward time to the end of the new reward period
			await time.increase(302400)

			// User 1 claims rewards at the end of the initial period
			const user1BalanceBefore = await usdtToken.balanceOf(user1.address)
			await symmStaking.connect(user1).claimRewards()
			const user1BalanceAfter = await usdtToken.balanceOf(user1.address)

			// The claimed rewards should be 604800 (all of first reward) + 151200 (half of the second reward) = 756000
			console.log("First claimed rewards: ", user1BalanceAfter - user1BalanceBefore) // actual 302400

			await time.increase(302400) // got to end of both rewards

			const user1BalanceBefore1 = await usdtToken.balanceOf(user1.address)
			await symmStaking.connect(user1).claimRewards()
			const user1BalanceAfter1 = await usdtToken.balanceOf(user1.address)

			// The claimed rewards should be 151200 the remaining half of the second reward
			// expect(user1BalanceAfter1 - user1BalanceBefore1).to.equal(rewardAmount)
			console.log("Second claimed rewards:", user1BalanceAfter1 - user1BalanceBefore1) // actual 0
		})

Mitigation

// Use a scaling factor to preserve precision
uint256 constant RATE_PRECISION = 1e18;

function _addRewardsForToken(address token, uint256 amount) internal {
    TokenRewardState storage state = rewardState[token];
    
    if (block.timestamp >= state.periodFinish) {
        state.rate = (amount * RATE_PRECISION) / state.duration;
    } else {
        uint256 remaining = state.periodFinish - block.timestamp;
        uint256 leftover = remaining * state.rate;
        state.rate = ((amount * RATE_PRECISION) + leftover) / state.duration;
    }
    
    require(state.rate > 0, "Reward rate cannot be zero");
    
    state.lastUpdated = block.timestamp;
    state.periodFinish = block.timestamp + state.duration;
}

By implementing the mitigation strategy, the SymmStaking contract can prevent the reward rate from being set to zero, ensuring that stakers continue to receive rewards as intended. The proof-of-concept demonstrates the vulnerability and the impact of the issue, highlighting the importance of addressing this problem to maintain trust in the staking mechanism.
Virtual Heather Guppy - Reward Rate Rounding to Zero in SymmStaking Contract causes loss of rewards for users - Q&A

Q: What is the SymmStaking contract and how does it work?

A: The SymmStaking contract is a crucial component of the Symm.io protocol, designed to facilitate staking and reward distribution to users. It allows users to deposit tokens and earn rewards based on their staking activity.

Q: What is the vulnerability in the SymmStaking contract?

A: The vulnerability lies in the _addRewardsForToken function, which calculates the reward rate by dividing the reward amount by the duration. If the reward amount is less than the duration, the division will result in zero, effectively stopping reward distribution.

Q: How can the vulnerability be exploited?

A: There are two main scenarios where this vulnerability can be exploited:

Initial reward setup: An attacker or mistaken admin adds a reward amount that is less than the duration.
Subsequent reward additions: For an ongoing reward period, if amount + leftover is less than state.duration.

Q: What are the consequences of the vulnerability?

A: The consequences of the vulnerability include:

Stakers receive no rewards despite tokens being added to the contract.
Loss of funds for the protocol as rewards are effectively locked.
Undermines trust in the staking mechanism.
May lead to mass unstaking if users notice they aren't receiving rewards.

Q: How can the vulnerability be mitigated?

A: The vulnerability can be mitigated by implementing a scaling factor to preserve precision. This can be achieved by multiplying the reward amount by a constant (e.g., 1e18) before dividing it by the duration.

Q: What is the impact of the vulnerability on the Symm.io protocol?

A: The vulnerability has a significant impact on the Symm.io protocol, as it can lead to a loss of trust in the staking mechanism and potentially cause mass unstaking. It is essential to address this issue to maintain the integrity of the protocol.

Q: How can users protect themselves from the vulnerability?

A: Users can protect themselves from the vulnerability by:

Verifying the reward amount before adding it to the contract.
Ensuring that the reward amount is sufficiently large to avoid rounding down to zero.
Monitoring their rewards and reporting any issues to the protocol administrators.

Q: What is the next step for the Symm.io protocol to address the vulnerability?

A: The next step for the Symm.io protocol is to implement the mitigation strategy and deploy the updated contract to prevent the vulnerability from occurring. This will ensure that stakers continue to receive rewards as intended and maintain trust in the staking mechanism.

Q: How can users stay informed about the vulnerability and its impact on the Symm.io protocol?

A: Users can stay informed about the vulnerability and its impact on the Symm.io protocol by:

Following the official Symm.io blog and social media channels.
Participating in the Symm.io community forums and discussions.
Monitoring the protocol's GitHub repository for updates and patches.

By staying informed and taking necessary precautions, users can protect themselves from the vulnerability and maintain trust in the Symm.io protocol.