Venus Prime - y4y's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/b11d9ef9db8237678567e66759003138f2368d23/contracts/Tokens/Prime/Prime.sol#L373

Vulnerability details

Impact

User's prime token may be burnt if the user has previously staked some XVS tokens, and later is directly issued a revocable prime token.

Proof of Concept

Suppose Bob wants to join the program and he has already deposited 900 XVS tokens to the vault. Then for some reason, the admin decide to award Bob by directly issuing a Prime token to him without notifying Bob. Now, Bob has the Prime token, and tokens[Bob].exists would return true. However, Bob continues to deposit 50 XVS token to the vault unknowingly, and it triggers the Prime::XVSUpdated() function, in the function:

    function xvsUpdated(address user) external {
        uint256 totalStaked = _xvsBalanceOfUser(user);
        bool isAccountEligible = isEligible(totalStaked);

        if (tokens[user].exists && !isAccountEligible) {
            if (tokens[user].isIrrevocable) {
                _accrueInterestAndUpdateScore(user);
            } else {
                _burn(user);
            }
        } else if (!isAccountEligible && !tokens[user].exists && stakedAt[user] > 0) {
            stakedAt[user] = 0;
        } else if (stakedAt[user] == 0 && isAccountEligible && !tokens[user].exists) {
            stakedAt[user] = block.timestamp;
        } else if (tokens[user].exists && isAccountEligible) {
            _accrueInterestAndUpdateScore(user);
        }
    }

since Bob doesn't have 1000 XVS tokens already, isAccountEligble would be false, and since Bob's Prime token is revocable, the _burn(user) line will be executed, which cause Bob to lose his newly received Prime token. Bob can still claim another Prime token later once the required staked amount is met, but he would have to wait another 90 days to do so. Causing him to lose potential interests and rewards.

Tools Used

Manual review.

Recommended Mitigation Steps

Add an additional attribute like directlyIssued for tokens are issued by issue function to users.

Assessed type

Context