A vulnerability of incentives

[wangjj9219]

Incentives module accumulates reward periodically in order to reduce reads and writes, but user can get whole period rewards by add liquidity in the previous block of the period, this is unreasonable.

A solution is: remove the period, record timestamp of the last accumulation occurs, and rebalance for specific rewards pool when current block == last_accumulated_block && following situation :

1. shares changed
2. withdraw rewards
3. rewards config changed
4. emergency shutdown

and update last_accumulated_block to current block after rebalance, front end can calculate real-time rewards through current_block and last_accumulated_block,

As long as the rebalance is not triggered, the system will have unsettled rewards(ACA or AUSD), but in reality, rebalance will happen frequently, and unsettled rewards will not have much impact on risk management.

@xlc What do you think?

[xlc]

Initially I was thinking the accumulate period will be like 20 blocks or something similar, so there isn't much to game with and it is easy to implement.

Make it lazy update will be more accurate and have more potential performance saving (I don't expect the average period between two update triggering events will be less than 20 blocks).