Canto Liquidity Mining Protocol - BoRonGod's results

Lines of code

https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/mixins/LiquidityMining.sol#L192-L195

Vulnerability details

Impact

Due to the expensive gas fees in Ethereum mainnet and the involvement of many status updates in the reward collection workflow, users with smaller liquidity volume may encounter situations where gas fees exceed the reward amount during the process of applying for liquidity rewards.

Proof of Concept

rewardsToSend is calculated below without value check:

uint256 rewardsToSend;
    for (uint256 i; i < weeksToClaim.length; ++i) {
        uint32 week = weeksToClaim[i];
        require(week + WEEK < block.timestamp, "Week not over yet");
        require(
            !concLiquidityRewardsClaimed_[poolIdx][posKey][week],
            "Already claimed"
        );
        uint256 overallInRangeLiquidity = timeWeightedWeeklyGlobalConcLiquidity_[poolIdx][week];
        if (overallInRangeLiquidity > 0) {
            uint256 inRangeLiquidityOfPosition;
            for (int24 j = lowerTick + 10; j <= upperTick - 10; ++j) {
                inRangeLiquidityOfPosition += timeWeightedWeeklyPositionInRangeConcLiquidity_[poolIdx][posKey][week][j];
            }
            // Percentage of this weeks overall in range liquidity that was provided by the user times the overall weekly rewards
            rewardsToSend += inRangeLiquidityOfPosition * concRewardPerWeek_[poolIdx][week] / overallInRangeLiquidity;
        }
        concLiquidityRewardsClaimed_[poolIdx][posKey][week] = true;
    }
    if (rewardsToSend > 0) {
        (bool sent, ) = owner.call{value: rewardsToSend}("");
        require(sent, "Sending rewards failed");
    }

Tools Used

manual check

Recommended Mitigation Steps

Maybe a minimum reward limit can be added.

Assessed type

Payable