Althea Liquid Infrastructure - AM's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L221

Vulnerability details

In contract LiquidInfrastructureERC20 in function setDistrbutableERC20s, the owner can overwrite the list of ERC20s that have entitlements to be sent to holders. There are two issues here:

• the setDistrbutableERC20s is not using the LockedForDistribution flag, meaning the array can be overwritten during an ongoing distribution
• the setDistrbutableERC20s can be wrongly called before a distribution happened locking the corresponding ercs

Impact

It leads to locked funds and unsent entitlements and can disrupt ongoing distributions due to lack of lock while updating the array of distributable ercs

Proof of Concept

Tools Used

Manual review

Recommended Mitigation Steps

1. Use the LockedForDistribution flag to make sure the values can't be overwritten during an ongoing distribution

    function setDistributableERC20s(
        address[] memory _distributableERC20s
    ) public onlyOwner {
        require(LockedForDistribution, "distribution ongoing");
        distributableERC20s = _distributableERC20s;
    }

2. Determine if a distribution happened and no ercs are left in the contract before calling the setDistrbutableERC20s to overwrite the distributableERC20s

Assessed type

Other