XDEFI contest - gpersoon's results

Handle

gpersoon

Vulnerability details

Impact

The function updateDistribution() calls _updateXDEFIBalance() and then updates _pointsPerUnit.

Suppose XDEFI tokens are send to the XDEFIDistribution contract and before updateDistribution() is called, one of the following functions is called:

• relock
• unlock
• relockBatch
• unlockBatch

Then the function _updateXDEFIBalance() is called, without doing anything with the result (e.g. not updating _pointsPerUnit). _updateXDEFIBalance() updates distributableXDEFI , so the next time it is called (with no new XDEFI tokens), it will return 0.

So even if you call updateDistribution() now, _pointsPerUnit is still not updated so the internal administration will not be ok.

Proof of Concept

https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L142-L154

 function updateDistribution() external {
        uint256 totalUnitsCached = totalUnits;
        require(totalUnitsCached > uint256(0), "NO_UNIT_SUPPLY");
        uint256 newXDEFI = _toUint256Safe(_updateXDEFIBalance());
        if (newXDEFI == uint256(0)) return;
        _pointsPerUnit += ((newXDEFI * _pointsMultiplier) / totalUnitsCached);
        emit DistributionUpdated(msg.sender, newXDEFI);
    }

https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L330-L335

 function _updateXDEFIBalance() internal returns (int256 newFundsTokenBalance_) {
        uint256 previousDistributableXDEFI = distributableXDEFI;
        uint256 currentDistributableXDEFI = distributableXDEFI = IERC20(XDEFI).balanceOf(address(this)) - totalDepositedXDEFI;  // updates distributableXDEFI 
        return _toInt256Safe(currentDistributableXDEFI) - _toInt256Safe(previousDistributableXDEFI);
    }

https://github.com/XDeFi-tech/xdefi-distribution/blob/master/contracts/XDEFIDistribution.sol#L110-L195

function relock(uint256 tokenId_, uint256 lockAmount_, uint256 duration_, address destination_) external noReenter returns (uint256 amountUnlocked_, uint256 newTokenId_) {
         ...
        _updateXDEFIBalance();
    }

    function unlock(uint256 tokenId_, address destination_) external noReenter returns (uint256 amountUnlocked_) {
        ...
        _updateXDEFIBalance();
    }

    function relockBatch(uint256[] memory tokenIds_, uint256 lockAmount_, uint256 duration_, address destination_) external noReenter returns (uint256 amountUnlocked_, uint256 newTokenId_) {
         ...
        _updateXDEFIBalance();
    }

    function unlockBatch(uint256[] memory tokenIds_, address destination_) external noReenter returns (uint256 amountUnlocked_) {
         ...
        _updateXDEFIBalance();
    }

Tools Used

Recommended Mitigation Steps

Replace the instances of _updateXDEFIBalance() with updateDistribution()