Ethereum Credit Guild - ast3ros's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/e3d3e581e0e51a9ecf3a5a0c4e4bd4af32552fc0/src/tokens/ERC20RebaseDistributor.sol#L362-L364

Vulnerability details

Impact

Malicious actors can exploit the distribute function in the CreditToken contract to indefinitely delay the complete distribution of credit rewards to users participating in rebasing.

Proof of Concept

In the current implementation of the CreditToken contract, the distribute function is publicly accessible, allowing any user to trigger the distribution of tokens to rebasing accounts. The distribution's end timestamp is set to block.timestamp + DISTRIBUTION_PERIOD, with DISTRIBUTION_PERIOD being 30 days.

    if (_rebasingSupply != 0) {
        // update rebasingSharePrice interpolation
        uint256 endTimestamp = block.timestamp + DISTRIBUTION_PERIOD;

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/e3d3e581e0e51a9ecf3a5a0c4e4bd4af32552fc0/src/tokens/ERC20RebaseDistributor.sol#L362-L364

A malicious user can repeatedly call the distribute function with a minimal amount (e.g., 1 wei). Each call extends the distribution period by an additional 30 days. By doing this continually, the malicious user can effectively prolong the distribution indefinitely. This action not only delays the reward distribution but also gradually decreases the rate of distribution, adversely affecting users who have entered rebasing.

For example, a scenario where the total reward pool is 300e18 tokens, intended to be distributed evenly over 30 days, which amounts to 10e18 tokens per day. At day 15th, there should be another 15 days left to distribute the remaining 150e18 tokens at the rate of 10e18 tokens per day. The malicious user call distribute with 1 wei, the total rewards is 150e18 + 1 wei and resets the distribution period to another 30 days. It means that the rate is now 5e18 per day. As we can see the rate is reduce significant (50%).

Tools Used

Manual

Recommended Mitigation Steps

Restrict the access to the distribute function by allowing only specific roles or authorized accounts to execute this function.

Assessed type

DoS