Origin extend discards 50 OGV of rewards

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 10564-extending-the-staking-duration-discards-rewards-openzeppelin. Standalone Foundry PoC and full write-up: 10564-extending-the-staking-duration-discards-rewards-openzeppelin_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/reward-calculation

Key info#


Protocol	Origin OGV staking
Finding	OpenZeppelin, AuditVault 10564
Vulnerable code	`OgvStaking.extend`
Harm	Bob loses 50 OGV; the 50 stays in the staking contract
Chain	local synthetic

TL;DR#

Alice and Bob each stake 100 points. 100 OGV of rewards accrue. Alice's collectRewards updates accRewardPerShare and pays her 50, which leaves Bob owed 50. extend writes rewardDebt = balance * acc / 1e12 and does not call _collectRewards, so Bob's claim becomes 0. A later collect pays him nothing. The 50 remains in the staking contract. Collecting before extend pays the 50.

The vulnerable code#

SOLIDITY

_mint(msg.sender, newPoints - oldPoints);
// @> VULN: rewardDebt is updated here with no prior _collectRewards, so the outstanding rewards are discarded
rewardDebt[msg.sender] = (balanceOf(msg.sender) * accRewardPerShare) / 1e12;

Root cause#

rewardDebt is an absolute debt. It is only meaningful if _collectRewards has just paid balance * acc / 1e12 - rewardDebt. extend updates the debt as if that payment happened. It did not, so the outstanding rewards are zeroed.

Preconditions#

Another staker has already collected, so accRewardPerShare reflects rewards Bob has not been paid. Bob then calls extend. Both stakes are 100 points and the reward pot is 100 OGV.

Attack walkthrough#

100 OGV is funded and Alice collects. She receives 50. accRewardPerShare becomes 5e11.
previewRewards(Bob) is 50 OGV.
Bob calls extend(0, 14 days).
rewardDebt snaps to 50 OGV. Preview drops to 0.
Bob's collect transfers 0. The staking contract's OGV balance is 50 higher than before the rewards arrived, and that 50 is unclaimable by Bob.

Diagrams#

flowchart TD A["Alice and Bob each stake 100"] --> B["100 OGV of rewards is funded"] B --> C["Alice collects and is paid 50"] C --> D["Bob is owed 50"] D --> E["VULN: extend snaps rewardDebt"] E --> F["Bob collects 0 and 50 OGV is stranded"]

Impact#

Bob loses 50 OGV of rewards he had already earned. The tokens sit in the staking contract. The control calls collectRewards before extend and Bob's balance is 50 OGV.

Remediation#

Call _collectRewards before updating rewardDebt in extend, or store debt per share so a balance change cannot erase unpaid rewards.

How to reproduce#

BASH

cd 10564-extending-the-staking-duration-discards-rewards-openzeppelin_exp
forge test -vv

Sources#

AuditVault finding: https://github.com/Auditware/AuditVault/blob/main/findings/10564-extending-the-staking-duration-discards-rewards-openzeppelin.md
OpenZeppelin: https://blog.openzeppelin.com/origin-governance-audit/
Audited function: https://github.com/OriginProtocol/ousd-governance/blob/2b9761606d4ac4062b69367ebbad88220cea45ce/contracts/OgvStaking.sol#L127

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 10564-extending-the-staking-duration-discards-rewards-openzeppelin_exp (evm-hack-registry mirror).
AuditVault finding: 10564-extending-the-staking-duration-discards-rewards-openzeppelin.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync