PoolTogether TwabRewards contest - defsec's results

A protocol for no loss prize savings on Ethereum

General Information

Platform: Code4rena

Start Date: 09/12/2021

Pot Size: $25,000 USDC

Total HM: 12

Participants: 25

Period: 4 days

Judge: LSDan

Total Solo HM: 4

Id: 64

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 4/25

Findings: 3

Award: $1,104.15

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: csanuragjain

Also found by: defsec, leastwood

Labels

bug
duplicate
3 (High Risk)

Awards

510.9568 USDC - $510.96

External Links

Handle

defsec

Vulnerability details

Impact

When the promotion is created, the _promotion.startTimestamp variable can be so old date. That will cause to affect to epoch calculation.

Proof of Concept

  1. Navigate to the following contract code.
_promotions[_nextPromotionId] = Promotion( msg.sender, _ticket, _token, _tokensPerEpoch, _startTimestamp, _epochDuration, _numberOfEpochs );
  1. StartTimestamp can be set any old date there is no threshold has been defined.

Tools Used

None

Consider to add require( _startTimestamp >= block.timestamp, "Should be more than current date");

#0 - PierrickGT

2021-12-13T15:55:58Z

Findings Information

🌟 Selected for report: pmerkleplant

Also found by: GiveMeTestEther, WatchPug, defsec, pauliax

Labels

bug
duplicate
3 (High Risk)

Awards

510.9568 USDC - $510.96

External Links

Handle

defsec

Vulnerability details

Impact

Pooltogether protocol allows different tokens to be used as promotion token. The Promotion contract do not appear to support rebasing/deflationary/inflationary tokens whose balance changes during transfers or over time. The necessary checks include at least verifying the amount of tokens transferred to contracts before and after the actual transfer to infer any fees/interest.

Proof of Concept

https://github.com/pooltogether/v4-periphery/blob/b520faea26bcf60371012f6cb246aa149abd3c7d/contracts/TwabRewards.sol#L111

Tools Used

Code Review

Make sure promotion token for any rebasing/inflation/deflation Add support in contracts for such tokens before accepting user-supplied tokens

#0 - PierrickGT

2021-12-13T15:39:02Z

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter