TRUST H2

[jankjr]

• Write tests to test for inflation attacks.
• Implement fix

[pmckelvy1]

let's document the current plan and reasoning at the top of the morpho collateral plugin / wrapper

[openzeppelin-code]

Trust H2

Generated at commit: 02e87a650944efb5435f2d348204e2d0ce3a9012

🚨 Vulnerabilities Summary

Process	Issues	Results
Contract Inspector	high note low critical Total	1 37 18 2 58
Dependency Checker	Total	0

---

For more details view the full report in OpenZeppelin Code

[pmckelvy1]

i think this pr is moving the right direction, but the new linear-reward-stream accounting seems to just be in parallel to the old accounting, and not actually affecting anything.

i think we should add a bunch of tests proving that the linear stream works, and then make them pass by integrating it correctly.

[akshatmittal]

So, something I see in this implementation is that the rewards aren't quite streaming but rather calling sync() updates how much of the rewards are 'unlocked'. I don't hate it, but I feel like if sync isn't called for a while we'd be locking rewards for quite some time. Maybe worth calling sync on withdraw/deposit just to make sure it's a bit more frequent. (Edit: nvm, seems _claimAndSyncRewards() is called on every transfer anyway, forgot about that)

Additionally, I was originally imagining this would work like Convex or StakeDAO on how they stream rewards over a week. To me, that makes more sense but I also see why it's done this way since it's extending the RewardableERC20 contract.

Looks good to me!