Lybra Finance - f00l's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/miner/ProtocolRewardsPool.sol#L236

Vulnerability details

Impact

this vulnerability would cause rewardPerTokenStored has an incorrect value.

  rewardPerTokenStored = rewardPerTokenStored + (amount * 1e36 / token.decimals()) / totalStaked();

this line is converting the token decimals to 1e18 for consistent calculations. but some ERC20 tokens decimals() function doesnt't return 1e18 such as USDC stable token decimals() returns 6. This would cause an calculating error.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

1. Configarator set the stableToken to some ERC20 token such as USDC
2. When call this function to distribute rewards this vulnerability would occur

Tools Used

Manual Review

Recommended Mitigation Steps

Assessed type

ERC20