search

code-423n4 / 2022-06-yieldy-findings

0 stars 0 forks source link

Setting `affiliateFee` too high can result in affiliate receiving all the reward tokens accumulated in `Staking.sol` #96

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L167-L170 https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/Staking.sol#L131

Vulnerability details

Impact

An invalid affiliateFee amount set by owner can result in all accumulated protocol revenue to be sent to the affiliate (FEE_ADDRESS).

Proof of Concept

  1. Protocol generates 9990 TOKE tokens in revenue and accumulates it in Staking.sol.
  2. Owner sets affiliateFee from 0 to 1_000_000 (10,000%) instead of 1000 (10%) by mistake.
  3. Owner claims the rewards from the next cycle.
  4. Let’s say, 10 TOKE tokens are received as reward.
  5. When sending the affiliate’s share, it calculates the share as (10 * 1_000_000 / 10_000) == 1000, which is all the protocol revenue in the contract.

Tools Used

VIM

Recommended Mitigation Steps

Check against a reasonable upper bound (e.g.: 10% of BASIS_POINTS) when setting affiliateFee through the setAffiliateFee() function.

toshiSat commented 2 years ago

duplicate #211