Accumulated rewards in FSTO can be stolen by the agent's owner

Rewards earned from FTSO by delegating voting power to signal providers can be stolen by the agent's owner, because of a mismatch between the reward token's address and WNAT's address in the CollateralPool contract. CPT holders forfeit the rewards.

function claimDelegationRewards(
    IRewardManager _rewardManager,
    uint24 _lastRewardEpoch,
    IRewardManager.RewardClaimWithProof[] calldata _proofs
)
    external
    onlyAgent
    nonReentrant
    returns (uint256)
{
@>>   uint256 balanceBefore = wNat.balanceOf(address(this));
    _rewardManager.claim(address(this), payable(address(this)), _lastRewardEpoch, true, _proofs);
@>>   uint256 balanceAfter = wNat.balanceOf(address(this));
    uint256 claimed = balanceAfter - balanceBefore;
    totalCollateral += claimed;
    assetManager.updateCollateral(agentVault, wNat);
    emit CPClaimedReward(claimed, 1);
    return claimed;
}

• Users contribute their WNATs to the agent’s pool.
• The owner’s agent delegates voting power to signal providers.
• The WNAT address is modified by the asset updater in the Flare Time Series Oracle (FTSO).
• AssetManagerController::updateContracts can be called by anyone, as it has no access control. The agent's owner spots the opportunity and calls CollateralPool::claimDelegationRewards, which transfers the new WNAT into the agent's pool. totalCollateral is unchanged, because the received token no longer matches the pool's collateral token.
• The agent's owner then calls CollateralPool::upgradeWNatContract, which merely swaps the old WNAT for the new version.
• Finally, the agent's owner sweeps the collected new WNAT as a reward, after announcing destruction.

Alpha: ask what breaks when an admin function is called. Here, changing the WNAT address is what opens the door for the agent owner.

Conclusion

This finding would earn you $33790. Always work out the impact of the admin functions.

Full Report
Codebase