Althea Liquid Infrastructure - KmanOfficial's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L198-L237 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445

Vulnerability details

Impact

During a distribution, whenever the distribute() is called the distributableERC20s array is accessed and the addresses are read from here in order to perform the required distributions per approved holder. If the distributableERC20s array values were to change at any time during the current distribution, the distribute() function may perform inaccurate distributions upon the newly assigned distributableERC20s array, unexpected transfers of various tokens or even result in failed transfers bricking the distribute() function.

Proof of Concept

Initially distributableERC20s has only 3 ERC20s to distribute amongst. For example USDT, USDC, ETH.

• distribute(50) is called, and distribution commences (lock in place) - 100 eligible wallets. Transaction done in batches of 50.

• First 50 with distribute() is called.

• Admin/owner changes distributableERC20s using setDistributableERC20s() to TUSD, ETH, USDC.

• distribute(100) is called again for the last 50 wallets - either transfers the incorrect distributions for the wrong ERC20 tokens to those wallets or fails due to insufficient balance within the contract.

Tools Used

Manual Code Review, VS Code

Recommended Mitigation Steps

In order to mitigate this risk, there is two suggestions:

1. Upon starting a new distribution round/lock, store a copy of the distributionERC20s array valid for the current distribution which can be removed from storage after it has ended. This copy would be referenced to throughout the current distribution.

2. Only allow the distributableERC20s array to be modified only when there is no distribution currently taking place (when !LockedForDistribution).

Assessed type

Token-Transfer