Althea Liquid Infrastructure - Kirkeelee's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445

Vulnerability details

Impact

Changing the content of distributableERC20s array during a distribution event poses significant risks that could undermine the integrity and fairness of the token distribution process. Specifically, altering the list of distributable ERC20 tokens during an active distribution can lead to inconsistent rewards among token holders, calculation errors due to added complexity, increased gas costs, execution failures, and a potential loss of trust from the community.

Proof of Concept

The vulnerability arises from the design of the LiquidInfrastructureERC20 smart contract, where the distributeToAllHolders function can be initiated by any user, not exclusively the contract owner. This opens a scenario where a distribution process might be ongoing, unbeknownst to the contract owner. If, during this period, the owner decides to update the list of distributable ERC20 tokens through the setDistributableERC20s function, inconsistencies can occur due to the lack of synchronization between these actions.

This scenario is particularly problematic because the smart contract does not implement a mechanism to lock the distribution list during an active distribution cycle, nor does it provide a status check to inform the owner or other users of an ongoing distribution. As a result, the contract owner might inadvertently call setDistributableERC20s, expecting to prepare for a future distribution, without realizing that a distribution process has already been initiated by someone else and has not yet been finalized.

User A initiates distributeToAllHolders: The distribution process begins, intending to distribute the current set of ERC20 tokens listed at the time of the call. Owner updates distributable tokens via setDistributableERC20s: Unaware of the ongoing distribution, the owner updates the list to include a new set of ERC20 tokens. Inconsistency in Distribution: The ongoing distribution process now faces a potential mismatch in the assets it was supposed to distribute versus the assets currently listed as distributable. This could result in some token holders receiving a different set of assets than others, or the distribution could fail due to the sudden change in available assets.

Tools Used

Manual review

Recommended Mitigation Steps

Implement locking mechanism within setDistributableERC20s function(require(!LockedForDistribution))to prevent updates to the distributable ERC20 tokens array during active distributions. This ensures consistency in the assets being distributed throughout the entire process.

Assessed type

Timing