Livepeer Onchain Treasury Upgrade - nadin's results

Lines of code

https://github.com/code-423n4/2023-08-livepeer/blob/main/contracts/bonding/BondingManager.sol#L1-L1674

Vulnerability details

Impact

Users usually go to the docs & specification to see how to integrate a project. Currently the documentation and the code do not match.

Proof of Concept

• Take a look at LIP-92 :

Parameters
contract BondingManager {
    function treasuryRewardCut() external view returns (uint256);
    function setTreasuryRewardCut(uint256 _value) external; // @audit this is NOT the setTreasuryRewardCut and _value, it's the setTreasuryRewardCutRate and _cutRate.

    function nextRoundTreasuryRewardCut() external view returns (uint256);

    function treasuryBalanceCeiling() external view returns (uint256);
    function setTreasuryBalanceCeiling(uint256 _value) external; // @audit this is NOT the _value, it's the _ceiling.

}

1. The current implementation of the BondingManager.sol contract does not have the function treasuryRewardCut().
2. The current implementation of the BondingManager.sol contract does not have the function setTreasuryRewardCut(). Instead there is a setTreasuryRewardCutRate() function : here

File: BondingManager.sol
167:    function setTreasuryRewardCutRate(uint256 _cutRate) external onlyControllerOwner {
168:        _setTreasuryRewardCutRate(_cutRate);
169:    }

3. The current implementation of the BondingManager.sol contract does not have the function nextRoundTreasuryRewardCut()
4. The current implementation of the BondingManager.sol contract does not have the function treasuryBalanceCeiling().
5. Wrong setTreasuryBalanceCeiling() interface :

• In Spec :

function setTreasuryBalanceCeiling(uint256 _value) external // @audit this is NOT the _value, it's the _ceiling.

• In BondingManager.sol : here

File: BondingManager.sol
176:    function setTreasuryBalanceCeiling(uint256 _ceiling) external onlyControllerOwner {

Tools Used

Manual review

Recommended Mitigation Steps

Use the correct docs by fixing the mentioned issues.

Assessed type

Other