Venus Prime - 0xTiwa's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/b11d9ef9db8237678567e66759003138f2368d23/contracts/Tokens/Prime/PrimeLiquidityProvider.sol#L118-L126

Vulnerability details

Impact

According to the NATSPEC comments of the initializeTokens(), the main function of the initializeTokens() is to initialize the distributions of tokens in the contract but it does not do that at all. The only thing it does in the function is initialize the tokens for the contract by setting the last accrued block time but if it is meant to initialize the distribution of the tokens it should also call the _setTokenDistributionSpeed() in the function with the appropriate variables.

Proof of Concept

 function initializeTokens(address[] calldata tokens_) external onlyOwner {
        for (uint256 i; i < tokens_.length; ) {
            _initializeToken(tokens_[i]);

            unchecked {
                ++i;
            }
        }
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Call the _setTokenDistributionSpeed() in the initializeTokens()

 function initializeTokens(address[] calldata tokens_, uint256[] calldata distributionSpeeds_) external onlyOwner {
        for (uint256 i; i < tokens_.length; ) {
            _initializeToken(tokens_[i]);
     _setTokenDistributionSpeed(tokens_[i], distributionSpeeds_[i]);
          unchecked {
                ++i;
            }
        }
    }

Assessed type

Other