BlockSec: OMNI ESTATE GROUP lost 236 BNB due to insufficient parameter checking in the StakingPool contract

According to BlockSec monitoring, the European real estate NFT market OMNI ESTATE GROUP was hacked and lost 236 BNB due to insufficient parameter checking in the StakingPool contract. An attacker can invest 1 wei to withdraw ORT token rewards. The reward is usually calculated by the _Check_reward function according to the deposit duration and amount, but the duration starts from the input parameter end_date, which value is not checked. In the _Check_reward function, if the duration parameter is invalid, it returns the default state variable (total_percent), which is 6000e18 at the beginning of the attack. The attack was funded by FixedFloat, where the attackers exchanged ORT tokens for BNB after launching multiple such attacks.