Althea Liquid Infrastructure - imare's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445

Vulnerability details

Impact

The owner of LiquidInfrastructureERC20 contract can change the list of distributable tokens in the middle of a distribution and in doing this it can block the process of the distribution or send wrong entitlement amounts to holders.

Proof of Concept

A distribution can run for more the one distribute call if we have a large number of holders to prevent a DOS situation. This is done by limiting the number of distribution per run:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L208-L214

To protect the distribution function from other contract operation that can interfere with the process the contract in the begining sets a variable :

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L257-L262

The distribution finally ends when the number of all transfers is equal to the number of holders:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L234-L236

But as already mentioned the owner can change the list of distributable tokens in the middle of the distribution process:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445

This list is used on the first distribute run to calculate all amounts entitlements for specific tokens :

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L271-L277

And this calculated values are used in for each holder per distribution run:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L222-L223

If the changed list is not the same we have two main problems :

• distribution will revert becouse the new list is shorter then the original one => a out of index revert will happen on this line:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L221

• if the list is larger or same size but the order of tokens or the tokens address in the new list are not the same, than the entitlement used are the wrong ones because this values are only calculated on the first distribute run:

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L222

Tools Used

Manual review

Recommended Mitigation Steps

Block the changing of the distributable ERC20 list when distribution is in progress :

    function setDistributableERC20s(
        address[] memory _distributableERC20s
    ) public onlyOwner {
+       require(!LockedForDistribution, "distribution in progress");
        distributableERC20s = _distributableERC20s;
    }

Assessed type

Other