Lybra Finance - ke1caM's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/miner/ProtocolRewardsPool.sol#L73-L77 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/miner/esLBRBoost.sol#L37-L45 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/miner/ProtocolRewardsPool.sol#L87-L98

Vulnerability details

When user calls stake function in ProtocolRewardsPool.sol user's LBR token is burned and esLBR token is minted. However, user's lock status is never set. Unstake function expects user to have an unlockTime but for not existing address in mapping, return value is zero, so the esLBRBoost.getUnlockTime will be 0. As in the requirements for user to convert esLBR to LBR according to comments in file "The current time must be greater than the unlock time retrieved from the boost contract for the user". This requirement will always pass.

Impact

Protocol functionality may be omitted.

Proof of Concept

setLockStatus is implemented but never used https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/miner/esLBRBoost.sol#L37-L45 unStake function uses esLBRBoost.getUnlockTime(msg.sender) https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/miner/ProtocolRewardsPool.sol#L87-L98

Tools Used

Manual analysis, Vscode

Recommended Mitigation Steps

Implement setLockStatus in stake function to keep track of user's data about lock status

Assessed type

Other