Althea Liquid Infrastructure - thank_you's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol?plain=1#L116-L119 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol?plain=1#L270-L277

Vulnerability details

Impact

When rewards are distributed, the entitled tokens for all holders is based on the token's total supply. If a holder is disapproved and still holds a balance, then the entitled tokens will still be distributed to the disapproved holders.

This results in approved holders receiving less entitled tokens since some entitled tokens are unable to be retrieved by disapproved holders.

Proof of Concept

There are two main code functions that are relevant for this bug:

function disapproveHolder(address holder) public onlyOwner {
    // AUDIT: this function toggles whether holder approved status. It does not handle the holder's balance.
    require(isApprovedHolder(holder), "holder not approved");
    HolderAllowlist[holder] = false;
}

function _beginDistribution() internal {
  ...
  uint256 supply = this.totalSupply();
  for (uint i = 0; i < distributableERC20s.length; i++) {
    uint256 balance = IERC20(distributableERC20s[i]).balanceOf(
        address(this)
    );
    // AUDIT: the entire total supply is used to calculate the entitlement. This can include a disapproved holder's
    uint256 entitlement = balance / supply;
    erc20EntitlementPerUnit.push(entitlement);

As you can see, when _beginDistribute is called the entitlement is calculated via uint256 entitlement = balance / supply. The supply variable takes into account disapproved holder balances. This results in the entitlement equaling less than if the disapproved holder's balances were not accounted for. Approved holders therefore will gain less entitled tokens whenever LiquidInfrastructureERC20.distribute() is called.

Tools Used

Manual inspection

Recommended Mitigation Steps

When LiquidInfrastructureERC20.disapproveHolder() is called the protocol should withdraw or burn the holder that is to be disapproved. This will ensure that entitled tokens will be properly distributed.

Code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol?plain=1#L116-L119

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol?plain=1#L270-L277

Assessed type

Error