[C02] Rewards pay out incorrectly when the service provider has a pending “decrease stake” request

[hareeshnagaraj]

• Directly return rewards after mint operation occurs in ClaimsManager, eliminate potential for miscalculated totalRewards when decrease is pending

[hareeshnagaraj]

Interestingly enough, we already have a test case to cover reward distribution when a decrease stake request is pending. However this was passing due to what seems like a coincidence.

Example: (assume no delegators)

sp1Stake - 100, sp1LockedUp - 50
sp2Stake - 100
Total Stake = 200

Rewards - 1,000

Inside validateClaimRewards:

totalLockedUp - 50
mintedRewards - 250, ((100 - 50) / 200) * 1,000 = 250
totalBalanceInStaking - 350
totalBalanceInSPFac = 100
totalBalanceInSPFac -= 50 = 50 <---- This is the incorrect operation
returns (totalBalanceInStaking=350, totalBalanceInSPFac=50, totalBalanceOutsideStaking=50)

In claimReward (after validateClaimRewards)
(totalBalanceInStaking=350, totalBalanceInSPFac=50, totalBalanceOutsideStaking=50)
totalRewards = 300 <---- This value is SKEWED, it should be 250.

So how did our final balance still come out correctly?

totalActiveFunds = 50
spRewardShare = (spFactoryBalance * totalRewards)/ totalActive --> (50 * 300) / 50 = 300
newSpFactoryBalance = 50 + 300 = 350 <--- This is the right final value even though our internal reward calculation was incorrect, because our input spFactoryBalance is already offset by the increase in totalRewards

[hareeshnagaraj]

follow-up - is this really a critical vulnerability if insolvency is not possible per the above example? because the final calculation is based on a skewed base value for spFactory balance (decreased by the same amount of increase in totalRewards), final state in spFactory is exactly right.