Althea Liquid Infrastructure - agadzhalov's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441

Vulnerability details

[M-3] Missing require for setDistributableERC20s during active distribution period can cause distribution of wrong reward tokens

Summary

Owner of protocol may overwrite distributableERC20s during an active distribution period which will lead to distribution of wrong/less valuable tokens.

PoC

1. Let's assume we have distributableERC20s = ["USDT", "USDC", "DAI"]
2. User executes distribute(1) and distribution period has started
3. Owner executes setDistributableERC20s intentionally or not and overwrites the distributableERC20s to ["DummyErc20One", "DummyErc20Two", "DummyErc20Three"]
4. In the case when the protocol has enough balance of the overwritten tokens when distribute or distributeToAllHolders is executed again wrong reward tokens will be distributed (L220-L224) https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L220
5. In the case when the protocol has no amount of the overwritten tokens no rewards token will be distributed at all.

Owner could overwrite distributableERC20s and scam innocent holders.

Impact

Execution of setDistributableERC20s from owner's side during an active distribution period may harm the innocent user to receive wrong/less valuable/undesirable reward tokens.

Recommended Mitigation Steps

Add require(_isPastMinDistributionPeriod() in setDistributableERC20s before overwriting distributableERC20s https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L443

Assessed type

Invalid Validation