Invalid equation check on require

[code423n4]

Handle

hagrid

Vulnerability details

The withdraw(uint256 rewardAmount) function on the AbstractRewardMine contract is wrongly controlling the reward amount.

Impact

Using the withdraw function instead of withdrawAll function will cost nearly same gas amount since these functions are nearly identical.

Proof of Concept

• https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/AbstractRewardMine.sol#L71-L75
• https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/AbstractRewardMine.sol#L77-L83

Tools Used

Manual Review

Recommended Mitigation Steps

require(rewardAmount <= rewardEarned, "< earned");
The require function above should be replaced with:
require(rewardAmount < rewardEarned, "< earned");

Else, both withdraw functions will be nearly identical.

[GalloDaSballo]

I agree with the warden that withdrawAll is basically the same as withdraw
withdraw could be made public and reused in withdrawAll