Olas - rvierdiiev's results

Lines of code

https://github.com/code-423n4/2023-12-autonolas/blob/main/tokenomics/contracts/Tokenomics.sol#L768

Vulnerability details

Proof of Concept

Amount that user receives when he purchases a bond depends on idf, which is taken for the previous epoch.

idf is calculated when checkpoint is done and it depends on numNewOwners that were rewarded in the current epoch. The bigger numNewOwners amount, the bigger the idf.

When service is donated, then each of its agents and components is rewarded. _trackServiceDonations function checks the owner of unit and in case if it was not stored before, it memorizes that owner and increases numNewOwners for the epoch. Once owner is stored, then he will not be added again in next epochs.

All units are just nfts that have owners and that can be transferred to anyone else. Thus, owners who already were stored in the mapNewOwners array can transfer ownership to another account to increase numNewOwners and idf.

While numNewOwners should show that new developers are coming into the protocol, the system can be fooled.

Impact

numNewOwners manipulation is possible by transferring unit ownership to another account, which will increase idf and bonds payout.

Tools Used

VsCode

Recommended Mitigation Steps

Can't propose good solution, as i believe that units should be transferrable by design. In case if you will store unit id instead, it will not work in same way as several units can have same author.

Assessed type

Error