Canto Liquidity Mining Protocol - matrix_0wl's results

Lines of code

https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/callpaths/LiquidityMiningPath.sol#L65 https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/callpaths/LiquidityMiningPath.sol#L74

Vulnerability details

Impact

The setConcRewards and setAmbRewards functions appear to set rewards for specific weeks within a given range for a liquidity mining pool. Whether these functions can be changed during an ongoing auction depends on the governance model and access control mechanisms implemented within the Canto Liquidity Mining project.

The setConcRewards and setAmbRewards functions can be changed anytime, even during ongoing auctions, and take effect immediately. Users may need time to react to the changes. The impacts maybe followings:

• some sudden changes may cause transactions fail
• some changes may change users expectation about the auction

Proof of Concept

File: canto_ambient/contracts/callpaths/LiquidityMiningPath.sol

    function setConcRewards(bytes32 poolIdx, uint32 weekFrom, uint32 weekTo, uint64 weeklyReward) public payable {
        // require(msg.sender == governance_, "Only callable by governance");
        require(weekFrom % WEEK == 0 && weekTo % WEEK == 0, "Invalid weeks");
        while (weekFrom <= weekTo) {
            concRewardPerWeek_[poolIdx][weekFrom] = weeklyReward;
            weekFrom += uint32(WEEK);
        }
    }

    function setAmbRewards(bytes32 poolIdx, uint32 weekFrom, uint32 weekTo, uint64 weeklyReward) public payable {
        // require(msg.sender == governance_, "Only callable by governance");
        require(weekFrom % WEEK == 0 && weekTo % WEEK == 0, "Invalid weeks");
        while (weekFrom <= weekTo) {
            ambRewardPerWeek_[poolIdx][weekFrom] = weeklyReward;
            weekFrom += uint32(WEEK);
        }
    }

Tools Used

VS Code

Recommended Mitigation Steps

• Do not apply changed parameters on ongoing auctions
• Add a timelock for the changes

Assessed type

Other