Althea Liquid Infrastructure - ziyou-'s results

Lines of code

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L257-L281 https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L198-L237

Vulnerability details

Impact

The inconsistency of ‘distributableERC20s’ within the ‘distribute’ function can occur when the ‘setDistributableERC20s’ function modifies the parameter ‘distributableERC20s’. This inconsistency may lead to malicious impacts, as the ‘distributableERC20s’ within the ‘_beginDistribution’ function and the ‘distributableERC20s’ within the ‘distribute’ function may differ.

Proof of Concept

function setDistributableERC20s(
    address[] memory _distributableERC20s
) public onlyOwner {

@ distributableERC20s = _distributableERC20s; } https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L441-L445

function _beginDistribution() internal {
    require(
        !LockedForDistribution,
        "cannot begin distribution when already locked"
    );
    LockedForDistribution = true;

    // clear the previous entitlements, if any
    if (erc20EntitlementPerUnit.length > 0) {
        delete erc20EntitlementPerUnit;
    }

    // Calculate the entitlement per token held
    uint256 supply = this.totalSupply();
    for (uint i = 0; i < distributableERC20s.length; i++) {

@ uint256 balance = IERC20(distributableERC20s[i]).balanceOf( address(this) ); uint256 entitlement = balance / supply; erc20EntitlementPerUnit.push(entitlement); }

    nextDistributionRecipient = 0;
    emit DistributionStarted();
}

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L257-L281

function distribute(uint256 numDistributions) public nonReentrant {
    require(numDistributions > 0, "must process at least 1 distribution");
    if (!LockedForDistribution) {
        require(
            _isPastMinDistributionPeriod(),
            "MinDistributionPeriod not met"
        );
        _beginDistribution();
    }

    uint256 limit = Math.min(
        nextDistributionRecipient + numDistributions,
        holders.length
    );

    uint i;
    for (i = nextDistributionRecipient; i < limit; i++) {
        address recipient = holders[i];
        if (isApprovedHolder(recipient)) {
            uint256[] memory receipts = new uint256[](
                distributableERC20s.length
            );
            for (uint j = 0; j < distributableERC20s.length; j++) {

@ IERC20 toDistribute = IERC20(distributableERC20s[j]); uint256 entitlement = erc20EntitlementPerUnit[j] * this.balanceOf(recipient); if (toDistribute.transfer(recipient, entitlement)) { receipts[j] = entitlement; } }

            emit Distribution(recipient, distributableERC20s, receipts);
        }
    }
    nextDistributionRecipient = i;

    if (nextDistributionRecipient == holders.length) {
        _endDistribution();
    }
}

https://github.com/code-423n4/2024-02-althea-liquid-infrastructure/blob/bd6ee47162368e1999a0a5b8b17b701347cf9a7d/liquid-infrastructure/contracts/LiquidInfrastructureERC20.sol#L198-L237

Tools Used

vs

Recommended Mitigation Steps

It is recommended to add a check to determine whether the ‘distribute’ function is currently being executed.

Assessed type

Other