veRWA - 0xG0P1's results

Lines of code

https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/LendingLedger.sol#L129-L143 https://github.com/code-423n4/2023-08-verwa/blob/a693b4db05b9e202816346a6f9cada94f28a2698/src/LendingLedger.sol#L204-L207

Vulnerability details

Impact

Users who have not provided liquidity can still claim Canto

Proof of Concept

The identified vulnerability pertains to the situation where a lending market undergoes blacklisting, leading to the preservation of user balances and market balance history. This potential security issue can be illustrated through the following scenario:

1. Consider a scenario in which Alice participates by providing 100 tokens as liquidity to a lending market during the X Epoch.

   • Alice's user balance: 100 tokens
   • Market balance: 100 tokens

2. Subsequently, Alice proceeds to claim rewards for each subsequent epoch (X + 1, X + 2, ...).

3. After a certain number of epochs, the governance of the lending market decides to impose a blacklist on the market.

4. Alice performs a withdrawal of her 100 tokens from the lending market. The attempt to synchronize the ledger through the execution of the sync_ledger function results in a reversion due to the blacklisting of the lending market. It is assumed that the lending market employs a try/catch mechanism to handle the reversion of the sync_ledger function. Consequently, Alice's balance within the lending market is reduced to zero.

5. Following a subsequent span of epochs, the lending market's blacklisting is lifted, effectively whitelisting the market once again. It's important to note that Alice's balance history is preserved within the lendingLedger.

6. Given this preserved balance history, Alice is enabled to claim rewards, despite the fact that she had previously withdrawn her 100 tokens from the lending market. This withdrawal, however, remains unrecorded as a consequence of the reversion experienced during the blacklisting period.

Tools Used

Manual review

Recommended Mitigation Steps

Introducing a potential resolution involves granting the lending market the capability to execute the sync_ledger function during the withdrawal of liquidity (Delta is negative). By doing so, both the user's balance and the market balance can be appropriately modified, even in scenarios where the lending market undergoes blacklisting. This approach ensures that when the lending market is eventually whitelisted, operational functionality is seamlessly restored.

Assessed type

Context