Althea Liquid Infrastructure - xchen1130's results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/main/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L444

Vulnerability details

Impact

When "LockedForDistribution" is true, "distributableERC20s" must NOT be changed; otherwise "distribute()" will malfunction which may lead to:

1. incorrect calculation because "erc20EntitlementPerUnit" does not match new "distributableERC20s"
2. revert when length of new "distributableERC20s" is bigger than length of "erc20EntitlementPerUnit"

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

add a check in "setDistributableERC20s()" to make sure it can be called only when "!LockedForDistribution": require( !LockedForDistribution, "cannot change DistributableERC20s when already locked" );

Assessed type

Timing