Althea Liquid Infrastructure - offside0011's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L214-L231

Vulnerability details

Impact

The revenue distribution process can be permanently disrupted.

Proof of Concept

It is important to note that the distribute(uint256 numDistributions) function is publicly accessible and can be called by anyone, at any time. This function has the ability to set the LiquidInfrastructureERC20 contract into Distribution Lock Mode by setting the LockedForDistribution variable to true. In the Distribution Lock Mode, the majority of the contract's functions are disabled, and users are unable to transfer LiquidInfrastructureERC20 tokens.

Most of the function will check whether the contract is under Distribution Lock Mode at the very begining, but one important function setDistributableERC20s(address[] memory _distributableERC20s) which is only callable by contract owner does not check that. The setDistributableERC20s() function set a very important vaiable distributableERC20s. It is used in the revenue distribution process as well.

File: LiquidInfrastructureERC20.sol
441:     function setDistributableERC20s(
442:         address[] memory _distributableERC20s
443:     ) public onlyOwner {
444:         distributableERC20s = _distributableERC20s;
445:     }

Suppose there are currently 10 holders. By calling distribute(x), (1 <= x <= 9), anyone can set the LiquidInfrastructureERC20 contract in a Distribution Lock Mode. After that, if the unconscious contract owner call the setDistributableERC20s() function and setting distributableERC20s to a new array, the whole revenue distribution process is tampered, while the contract is still in a Distribution Lock Mode.

It is crucial to recognize that a malicious and well-prepared hacker can monitor the transaction mempool and front-run the owner's transaction that calls the setDistributableERC20s function. Consequently, if the transaction is front-run, the setDistributableERC20s call becomes highly dangerous.

Tools Used

Audit

Recommended Mitigation Steps

Add check for LockedForDistribution before reassigning distributableERC20s.

    function setDistributableERC20s(
        address[] memory _distributableERC20s
    ) public onlyOwner {
+       require(!LockedForDistribution);
        distributableERC20s = _distributableERC20s;
    }

Side note: Instead of proactively sending back the revenue to the holders, the LiquidInfrastructureERC20 token developers can consider doing ledger in the LiquidInfrastructureERC20 and wait for holder to withdrawal.

Assessed type

Invalid Validation