# Increasing emissionEnd after the previous emissionEnd ended will yield full rewards according to newEmissionEnd - prevEmissionEnd Crit/High · Three Sigma · Omnichain RWA tokenisation · 6th April, 2024 Finding 3S-MZ-H02 of the MetaZero Staking security review. - Protocol: https://metazero.gg/ - Report: /reports/metazero-ii - Codebase: https://github.com/0xsimao/stakingContract/tree/dffac73e838a9fbd12bed18e41b9799177bcde7f - Source: https://cdn.sanity.io/files/qoqld077/production/3e07b0c2806b62578b8031e88c59bc5dbd38de1b.pdf --- ### Description Rewards are emitted at a certain rewardRate, which means stakers that have been staking for longer receive more rewards. However, there is an edge case in which this does not happen. When the emissionEnd is reached, lastApplicableTime() will always be emissionEnd. This means that anyone who stakes after emissionEnd, no matter how much time after it, will have the same rewardDebt stored. Thus, if the emissionEnd is increased after it has ended, every staker will receive the same rewards according to newEmissionEnd - prevEmissionEnd, even if they have staked in the same block that the emissionEnd was increased. Putting this thought into numbers, if emissionEnd = 10, and if at block.timestamp = 15, a new emissionEnd is set to 20, stakers that staked from the beginning will get rewards pro-rata to 15-10 at the current timestamp, the same as stakers who staked at the current block.timestamp = 15, if they frontrun the setEmissionDetails() call. ### Recommendation The protocol decided to remove this functionality. ### Status Addressed in [#7455c9c](https://github.com/metazerogg/stakingContract/commit/7455c9c5c52fe98aff2e336c0712b18ba8a49098). --- Related findings: - [StakingPool is missing rewards distribution end logic](https://0xsimao.com/findings/spirit-protocol-staking-rewards-distribution-end): Spirit Protocol - [Anyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewards](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-rewards-duration-harms-little): Exactly Protocol Update - Staking Contract - [Rewards can disappear when new rewards are distributed in the RewardsController.](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-rewards-disappear-distributed-controller): Exactly Protocol Update - Staking Contract