Short Olive Penguin - notifyRewardAmount calls updateIndex() twice, making the second update useless

[sherlock-admin4]

Short Olive Penguin

Low/Info

notifyRewardAmount calls updateIndex() twice, making the second update useless

Summary

StakedEXA::notifyRewardAmount() can only be called by the admin role, in the call trace, the updateIndex() is called twice, first is line 454
https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/StakedEXA.sol#L454
second is line 210
https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/StakedEXA.sol#L210

Vulnerability Detail

When first call the updateIndex(), it sets rewardData.index to globalIndex(reward), deep into the globalIndex(), there is (rewardData.rate * (lastTimeRewardApplicable(rewardData.finishAt) - rewardData.updatedAt)), because rewardData.updatedAt is set to lastTimeRewardApplicable(rewardData.finishAt) at line 122.So the second call of updateIndex() will result in rewardData.rate * 0, which is meaning less.

Impact

multiple call may cause undesirable behavior and results in unexpected results.

Code Snippet

https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/StakedEXA.sol#L454
https://github.com/sherlock-audit/2024-07-exactly-stacking-contracts/blob/main/protocol/contracts/StakedEXA.sol#L210

Tool used

Manual Review

Recommendation

Remove the first updateIndex()

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits:
exactly/protocol#758

[sherlock-admin2]

The Lead Senior Watson signed off on the fix.