Contract

// SPDX-License-Identifier: UNLICENSED
// solhint-disable-next-line compiler-fixed, compiler-gt-0_8
pragma solidity ^0.8.0;

import "./interfaces/IRewardAdviser.sol";

interface IEntitled {
    function entitled(address) external view returns (uint256);
}

/**
 * @title StakeRewardController2
 * @notice A bug in RewardPool contract at eth:0xcF463713521Af5cE31AD18F6914f3706493F10e5, after
 * the `endTime`, prevents the RewardMaster (eth:0x347a58878D04951588741d4d16d54B742c7f60fC) from
 * sending staking reward tokens to stakers. This contract implements a work-around.
 * @dev On `unstake` method call on the Staking (eth:0xf4d06d72dACdD8393FA4eA72FdcC10049711F899),
 * the later calls the RewardMaster, which then calls `getRewardAdvice` method on this contract
 * to process the `UNSTAKED` messages.
 * This contract returns the "advice" for the RewardMaster with zero `sharesToRedeem`. On the zero
 * advice received, the RewardMaster skips sending reward tokens to the staker, so the buggy code
 * `require(timeNow() < endTime` in the `RewardPool::vestRewards` method does not get called.
 * Furthermore, this contract transfers reward tokens to a staker instead of the RewardMaster as
 * follows. As a part of the `getRewardAdvice` call, this contract:
 * - requests the RewardMaster on the amount of rewards that the staker is already entitled to
 * (there are no mare rewards expected, as the rewarded period ended)
 * - sends the reward amount from this its balance to the staker
 * As a prerequisite, this contract:
 * - shall be authorized as the "RewardAdviser" with the RewardMaster for "classic" stakes
 * - shall hold reward tokens on its balance
 */
contract StakeRewardController2 is IRewardAdviser {
    // solhint-disable var-name-mixedcase

    /// @notice The owner who has privileged rights
    address public immutable OWNER;

    /// @notice The ERC20 token to pay rewards in
    address public immutable REWARD_TOKEN;

    /// @notice Staking contract instance that handles stakes
    address public immutable STAKING;

    /// @notice RewardMaster instance authorized to call `getRewardAdvice` on this contract
    address public immutable REWARD_MASTER;

    // bytes4(keccak256("classic"))
    bytes4 private constant STAKE_TYPE = 0x4ab0941a;
    // bytes4(keccak256(abi.encodePacked(bytes4(keccak256("unstake"), STAKE_TYPE)))
    bytes4 private constant UNSTAKE = 0x493bdf45;

    // 2022-08-15T00:00:00.000Z
    uint256 private constant ZKP_RESCUE_ALLOWED_SINCE = 1660521600;

    // solhint-enable var-name-mixedcase

    uint256 public unclaimedRewards;
    /// @notice Mapping from staker to claimed reward amount
    mapping(address => uint256) public rewardsClaimed;

    uint256 private _reentrancyStatus;

    /// @dev Emitted when reward paid to a staker
    event RewardPaid(address indexed staker, uint256 reward);

    /// @dev Emitted on activation of this contract
    event Activated(uint256 _activeSince, uint256 _totalStaked, uint256 scArpt);

    constructor(
        address _owner,
        address token,
        address stakingContract,
        address rewardMaster,
        uint256 _unclaimedRewards
    ) {
        require(
            _unclaimedRewards != 0 &&
                _owner != address(0) &&
                token != address(0) &&
                stakingContract != address(0) &&
                rewardMaster != address(0),
            "SRC: E1"
        );

        OWNER = _owner;
        REWARD_TOKEN = token;
        STAKING = stakingContract;
        REWARD_MASTER = rewardMaster;
        unclaimedRewards = _unclaimedRewards;
    }

    function getRewardAdvice(bytes4 action, bytes memory message)
        external
        override
        returns (Advice memory)
    {
        require(msg.sender == REWARD_MASTER, "SRC: unauthorized");
        require(action == UNSTAKE, "SRC: unexpected action");

        address staker = _decodeStakerFromMsg(message);
        require(staker != address(0), "SRC: unexpected zero staker");

        _payRewardIfNotYetPaid(staker);

        return
            Advice(
                address(0), // createSharesFor
                0, // sharesToCreate
                address(0), // redeemSharesFrom
                0, // sharesToRedeem
                address(this) // sendRewardTo
            );
    }

    /// @notice Returns reward token amount entitled to the given user/account
    function entitled(address staker) external view returns (uint256 rewards) {
        rewards = (rewardsClaimed[staker] == 0)
            ? _getEntitledReward(staker)
            : 0;
    }

    /// @notice Withdraws unclaimed rewards or accidentally sent token from this contract
    /// @dev May be only called by the {OWNER}
    function rescueErc20(
        address token,
        address to,
        uint256 amount
    ) external {
        require(_reentrancyStatus != 1, "SRC: can't be re-entered");
        _reentrancyStatus = 1;

        require(OWNER == msg.sender, "SRC: unauthorized");
        require(
            (token != REWARD_TOKEN) ||
                (block.timestamp >= ZKP_RESCUE_ALLOWED_SINCE),
            "SRC: too early withdrawal"
        );

        _transferErc20(token, to, amount);
        _reentrancyStatus = 2;
    }

    function _payRewardIfNotYetPaid(address staker) internal {
        // Do nothing if already paid
        if (rewardsClaimed[staker] != 0) return;

        uint256 reward = _getEntitledReward(staker);
        if (reward == 0) return;

        uint256 _unclaimedRewards = unclaimedRewards;

        // Precaution against imprecise calculations/roundings
        if (reward > _unclaimedRewards) reward = _unclaimedRewards;

        rewardsClaimed[staker] = reward;
        unclaimedRewards = _unclaimedRewards - reward;

        // trusted contract - reentrancy guard unneeded
        _transferErc20(REWARD_TOKEN, staker, reward);
        emit RewardPaid(staker, reward);
    }

    function _decodeStakerFromMsg(bytes memory message)
        internal
        pure
        returns (address staker)
    {
        uint256 stakerAndAmount;
        // solhint-disable-next-line no-inline-assembly
        assembly {
            // the 1st word (32 bytes) contains the `message.length`
            // we need the (entire) 2nd word ..
            stakerAndAmount := mload(add(message, 0x20))
        }
        staker = address(uint160(stakerAndAmount >> 96));
    }

    // Declared as `internal` to ease testing
    function _getEntitledReward(address staker)
        internal
        view
        returns (uint256 reward)
    {
        // trusted contract - reentrancy guard unneeded
        reward = IEntitled(REWARD_MASTER).entitled(staker);
    }

    function _transferErc20(
        address token,
        address to,
        uint256 value
    ) internal {
        // solhint-disable-next-line avoid-low-level-calls
        (bool success, bytes memory data) = token.call(
            // bytes4(keccak256(bytes('transfer(address,uint256)')));
            abi.encodeWithSelector(0xa9059cbb, to, value)
        );
        require(
            success && (data.length == 0 || abi.decode(data, (bool))),
            "SRC: transferErc20 failed"
        );
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

interface IRewardAdviser {
    struct Advice {
        // advice on new "shares" (in the reward pool) to create
        address createSharesFor;
        uint96 sharesToCreate;
        // advice on "shares" to redeem
        address redeemSharesFrom;
        uint96 sharesToRedeem;
        // advice on address the reward against redeemed shares to send to
        address sendRewardTo;
    }

    function getRewardAdvice(bytes4 action, bytes memory message)
        external
        returns (Advice memory);
}

{
  "metadata": {
    "bytecodeHash": "none",
    "useLiteralContent": true
  },
  "optimizer": {
    "enabled": true,
    "runs": 800
  },
  "outputSelection": {
    "*": {
      "*": [
        "evm.bytecode",
        "evm.deployedBytecode",
        "devdoc",
        "userdoc",
        "metadata",
        "abi"
      ]
    }
  },
  "libraries": {}
}

• No Contract Security Audit Submitted- Submit Audit Here

[{"inputs":[{"internalType":"address","name":"_owner","type":"address"},{"internalType":"address","name":"token","type":"address"},{"internalType":"address","name":"stakingContract","type":"address"},{"internalType":"address","name":"rewardMaster","type":"address"},{"internalType":"uint256","name":"_unclaimedRewards","type":"uint256"}],"stateMutability":"nonpayable","type":"constructor"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"uint256","name":"_activeSince","type":"uint256"},{"indexed":false,"internalType":"uint256","name":"_totalStaked","type":"uint256"},{"indexed":false,"internalType":"uint256","name":"scArpt","type":"uint256"}],"name":"Activated","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"staker","type":"address"},{"indexed":false,"internalType":"uint256","name":"reward","type":"uint256"}],"name":"RewardPaid","type":"event"},{"inputs":[],"name":"OWNER","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"REWARD_MASTER","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"REWARD_TOKEN","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"STAKING","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address","name":"staker","type":"address"}],"name":"entitled","outputs":[{"internalType":"uint256","name":"rewards","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"bytes4","name":"action","type":"bytes4"},{"internalType":"bytes","name":"message","type":"bytes"}],"name":"getRewardAdvice","outputs":[{"components":[{"internalType":"address","name":"createSharesFor","type":"address"},{"internalType":"uint96","name":"sharesToCreate","type":"uint96"},{"internalType":"address","name":"redeemSharesFrom","type":"address"},{"internalType":"uint96","name":"sharesToRedeem","type":"uint96"},{"internalType":"address","name":"sendRewardTo","type":"address"}],"internalType":"struct IRewardAdviser.Advice","name":"","type":"tuple"}],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"token","type":"address"},{"internalType":"address","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"rescueErc20","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"","type":"address"}],"name":"rewardsClaimed","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"unclaimedRewards","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"}]

61010060405234801561001157600080fd5b50604051610c34380380610c348339810160408190526100309161010b565b801580159061004757506001600160a01b03851615155b801561005b57506001600160a01b03841615155b801561006f57506001600160a01b03831615155b801561008357506001600160a01b03821615155b6100bd5760405162461bcd60e51b81526020600482015260076024820152665352433a20453160c81b604482015260640160405180910390fd5b6001600160601b0319606095861b811660805293851b841660a05291841b831660c05290921b1660e052600055610168565b80516001600160a01b038116811461010657600080fd5b919050565b600080600080600060a08688031215610122578081fd5b61012b866100ef565b9450610139602087016100ef565b9350610147604087016100ef565b9250610155606087016100ef565b9150608086015190509295509295909350565b60805160601c60a05160601c60c05160601c60e05160601c610a656101cf600039600081816101060152818161041c01526106f60152600061014e0152600081816101750152818161030f01526107e501526000818160ad01526102970152610a656000f3fe608060405234801561001057600080fd5b50600436106100a35760003560e01c806397610f3011610076578063d3f730fd1161005b578063d3f730fd14610197578063e9cb0324146101b7578063f85f91b41461022f57600080fd5b806397610f301461014957806399248ea71461017057600080fd5b8063117803e3146100a8578063243feb99146100ec578063576eadd2146101015780636e1ede7214610128575b600080fd5b6100cf7f000000000000000000000000000000000000000000000000000000000000000081565b6040516001600160a01b0390911681526020015b60405180910390f35b6100ff6100fa366004610890565b610238565b005b6100cf7f000000000000000000000000000000000000000000000000000000000000000081565b61013b61013636600461086f565b6103b2565b6040519081526020016100e3565b6100cf7f000000000000000000000000000000000000000000000000000000000000000081565b6100cf7f000000000000000000000000000000000000000000000000000000000000000081565b61013b6101a536600461086f565b60016020526000908152604090205481565b6101ca6101c53660046108eb565b6103e6565b6040516100e39190600060a0820190506001600160a01b0380845116835260208401516bffffffffffffffffffffffff808216602086015282604087015116604086015280606087015116606086015250508060808501511660808401525092915050565b61013b60005481565b600254600114156102905760405162461bcd60e51b815260206004820152601860248201527f5352433a2063616e27742062652072652d656e7465726564000000000000000060448201526064015b60405180910390fd5b60016002557f00000000000000000000000000000000000000000000000000000000000000006001600160a01b0316331461030d5760405162461bcd60e51b815260206004820152601160248201527f5352433a20756e617574686f72697a65640000000000000000000000000000006044820152606401610287565b7f00000000000000000000000000000000000000000000000000000000000000006001600160a01b0316836001600160a01b031614158061035257506362f98c804210155b61039e5760405162461bcd60e51b815260206004820152601960248201527f5352433a20746f6f206561726c79207769746864726177616c000000000000006044820152606401610287565b6103a98383836105a4565b50506002805550565b6001600160a01b038116600090815260016020526040812054156103d75760006103e0565b6103e0826106d4565b92915050565b6040805160a081018252600080825260208201819052918101829052606081018290526080810191909152336001600160a01b037f000000000000000000000000000000000000000000000000000000000000000016146104895760405162461bcd60e51b815260206004820152601160248201527f5352433a20756e617574686f72697a65640000000000000000000000000000006044820152606401610287565b7fffffffff00000000000000000000000000000000000000000000000000000000831663493bdf4560e01b146105015760405162461bcd60e51b815260206004820152601660248201527f5352433a20756e657870656374656420616374696f6e000000000000000000006044820152606401610287565b6000610511836020015160601c90565b90506001600160a01b0381166105695760405162461bcd60e51b815260206004820152601b60248201527f5352433a20756e6578706563746564207a65726f207374616b657200000000006044820152606401610287565b61057281610772565b50506040805160a081018252600080825260208201819052918101829052606081019190915230608082015292915050565b604080516001600160a01b038481166024830152604480830185905283518084039091018152606490920183526020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1663a9059cbb60e01b179052915160009283929087169161061591906109e6565b6000604051808303816000865af19150503d8060008114610652576040519150601f19603f3d011682016040523d82523d6000602084013e610657565b606091505b509150915081801561068157508051158061068157508080602001905181019061068191906108cb565b6106cd5760405162461bcd60e51b815260206004820152601960248201527f5352433a207472616e736665724572633230206661696c6564000000000000006044820152606401610287565b5050505050565b60405163370f6f3960e11b81526001600160a01b0382811660048301526000917f000000000000000000000000000000000000000000000000000000000000000090911690636e1ede729060240160206040518083038186803b15801561073a57600080fd5b505afa15801561074e573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906103e091906109ce565b6001600160a01b038116600090815260016020526040902054156107935750565b600061079e826106d4565b9050806107a9575050565b600054808211156107b8578091505b6001600160a01b03831660009081526001602052604090208290556107dd8282610a1f565b60005561080b7f000000000000000000000000000000000000000000000000000000000000000084846105a4565b826001600160a01b03167fe2403640ba68fed3a2f88b7557551d1993f84b99bb10ff833f0cf8db0c5e04868360405161084691815260200190565b60405180910390a2505050565b80356001600160a01b038116811461086a57600080fd5b919050565b600060208284031215610880578081fd5b61088982610853565b9392505050565b6000806000606084860312156108a4578182fd5b6108ad84610853565b92506108bb60208501610853565b9150604084013590509250925092565b6000602082840312156108dc578081fd5b81518015158114610889578182fd5b600080604083850312156108fd578182fd5b82357fffffffff000000000000000000000000000000000000000000000000000000008116811461092c578283fd5b9150602083013567ffffffffffffffff80821115610948578283fd5b818501915085601f83011261095b578283fd5b81358181111561096d5761096d610a42565b604051601f8201601f19908116603f0116810190838211818310171561099557610995610a42565b816040528281528860208487010111156109ad578586fd5b82602086016020830137856020848301015280955050505050509250929050565b6000602082840312156109df578081fd5b5051919050565b60008251815b81811015610a0657602081860181015185830152016109ec565b81811115610a145782828501525b509190910192915050565b600082821015610a3d57634e487b7160e01b81526011600452602481fd5b500390565b634e487b7160e01b600052604160045260246000fdfea164736f6c6343000804000a000000000000000000000000505796f5bc290269d2522cf19135ad7aa60dfd77000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa173000000000000000000000000f4d06d72dacdd8393fa4ea72fdcc10049711f899000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc00000000000000000000000000000000000000000002f0f115b473c585f1a000

0x608060405234801561001057600080fd5b50600436106100a35760003560e01c806397610f3011610076578063d3f730fd1161005b578063d3f730fd14610197578063e9cb0324146101b7578063f85f91b41461022f57600080fd5b806397610f301461014957806399248ea71461017057600080fd5b8063117803e3146100a8578063243feb99146100ec578063576eadd2146101015780636e1ede7214610128575b600080fd5b6100cf7f000000000000000000000000505796f5bc290269d2522cf19135ad7aa60dfd7781565b6040516001600160a01b0390911681526020015b60405180910390f35b6100ff6100fa366004610890565b610238565b005b6100cf7f000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc81565b61013b61013636600461086f565b6103b2565b6040519081526020016100e3565b6100cf7f000000000000000000000000f4d06d72dacdd8393fa4ea72fdcc10049711f89981565b6100cf7f000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa17381565b61013b6101a536600461086f565b60016020526000908152604090205481565b6101ca6101c53660046108eb565b6103e6565b6040516100e39190600060a0820190506001600160a01b0380845116835260208401516bffffffffffffffffffffffff808216602086015282604087015116604086015280606087015116606086015250508060808501511660808401525092915050565b61013b60005481565b600254600114156102905760405162461bcd60e51b815260206004820152601860248201527f5352433a2063616e27742062652072652d656e7465726564000000000000000060448201526064015b60405180910390fd5b60016002557f000000000000000000000000505796f5bc290269d2522cf19135ad7aa60dfd776001600160a01b0316331461030d5760405162461bcd60e51b815260206004820152601160248201527f5352433a20756e617574686f72697a65640000000000000000000000000000006044820152606401610287565b7f000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa1736001600160a01b0316836001600160a01b031614158061035257506362f98c804210155b61039e5760405162461bcd60e51b815260206004820152601960248201527f5352433a20746f6f206561726c79207769746864726177616c000000000000006044820152606401610287565b6103a98383836105a4565b50506002805550565b6001600160a01b038116600090815260016020526040812054156103d75760006103e0565b6103e0826106d4565b92915050565b6040805160a081018252600080825260208201819052918101829052606081018290526080810191909152336001600160a01b037f000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc16146104895760405162461bcd60e51b815260206004820152601160248201527f5352433a20756e617574686f72697a65640000000000000000000000000000006044820152606401610287565b7fffffffff00000000000000000000000000000000000000000000000000000000831663493bdf4560e01b146105015760405162461bcd60e51b815260206004820152601660248201527f5352433a20756e657870656374656420616374696f6e000000000000000000006044820152606401610287565b6000610511836020015160601c90565b90506001600160a01b0381166105695760405162461bcd60e51b815260206004820152601b60248201527f5352433a20756e6578706563746564207a65726f207374616b657200000000006044820152606401610287565b61057281610772565b50506040805160a081018252600080825260208201819052918101829052606081019190915230608082015292915050565b604080516001600160a01b038481166024830152604480830185905283518084039091018152606490920183526020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1663a9059cbb60e01b179052915160009283929087169161061591906109e6565b6000604051808303816000865af19150503d8060008114610652576040519150601f19603f3d011682016040523d82523d6000602084013e610657565b606091505b509150915081801561068157508051158061068157508080602001905181019061068191906108cb565b6106cd5760405162461bcd60e51b815260206004820152601960248201527f5352433a207472616e736665724572633230206661696c6564000000000000006044820152606401610287565b5050505050565b60405163370f6f3960e11b81526001600160a01b0382811660048301526000917f000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc90911690636e1ede729060240160206040518083038186803b15801561073a57600080fd5b505afa15801561074e573d6000803e3d6000fd5b505050506040513d601f19601f820116820180604052508101906103e091906109ce565b6001600160a01b038116600090815260016020526040902054156107935750565b600061079e826106d4565b9050806107a9575050565b600054808211156107b8578091505b6001600160a01b03831660009081526001602052604090208290556107dd8282610a1f565b60005561080b7f000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa17384846105a4565b826001600160a01b03167fe2403640ba68fed3a2f88b7557551d1993f84b99bb10ff833f0cf8db0c5e04868360405161084691815260200190565b60405180910390a2505050565b80356001600160a01b038116811461086a57600080fd5b919050565b600060208284031215610880578081fd5b61088982610853565b9392505050565b6000806000606084860312156108a4578182fd5b6108ad84610853565b92506108bb60208501610853565b9150604084013590509250925092565b6000602082840312156108dc578081fd5b81518015158114610889578182fd5b600080604083850312156108fd578182fd5b82357fffffffff000000000000000000000000000000000000000000000000000000008116811461092c578283fd5b9150602083013567ffffffffffffffff80821115610948578283fd5b818501915085601f83011261095b578283fd5b81358181111561096d5761096d610a42565b604051601f8201601f19908116603f0116810190838211818310171561099557610995610a42565b816040528281528860208487010111156109ad578586fd5b82602086016020830137856020848301015280955050505050509250929050565b6000602082840312156109df578081fd5b5051919050565b60008251815b81811015610a0657602081860181015185830152016109ec565b81811115610a145782828501525b509190910192915050565b600082821015610a3d57634e487b7160e01b81526011600452602481fd5b500390565b634e487b7160e01b600052604160045260246000fdfea164736f6c6343000804000a

000000000000000000000000505796f5bc290269d2522cf19135ad7aa60dfd77000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa173000000000000000000000000f4d06d72dacdd8393fa4ea72fdcc10049711f899000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc00000000000000000000000000000000000000000002f0f115b473c585f1a000

-----Decoded View---------------
Arg [0] : _owner (address): 0x505796f5Bc290269D2522cf19135aD7Aa60dfd77
Arg [1] : token (address): 0x909E34d3f6124C324ac83DccA84b74398a6fa173
Arg [2] : stakingContract (address): 0xf4d06d72dACdD8393FA4eA72FdcC10049711F899
Arg [3] : rewardMaster (address): 0x347a58878D04951588741d4d16d54B742c7f60fC
Arg [4] : _unclaimedRewards (uint256): 3555666824442000000000000

-----Encoded View---------------
5 Constructor Arguments found :
Arg [0] : 000000000000000000000000505796f5bc290269d2522cf19135ad7aa60dfd77
Arg [1] : 000000000000000000000000909e34d3f6124c324ac83dcca84b74398a6fa173
Arg [2] : 000000000000000000000000f4d06d72dacdd8393fa4ea72fdcc10049711f899
Arg [3] : 000000000000000000000000347a58878d04951588741d4d16d54b742c7f60fc
Arg [4] : 00000000000000000000000000000000000000000002f0f115b473c585f1a000