Open code423n4 opened 1 year ago
Picodes marked the issue as primary issue
In the current design, a new distribution period can start before the challenge stage ends. Those funds won't be re-added to the treasury and made available until the next distribution period. _updateTreasury
has logic to look back up to two previous distribution periods, and re-add funds to the treasury if they haven't been added already.
That being said, we are moving ahead with a change to prevent the distribution period from starting until the challenge stage ends, and then automatically re-adding any surplus on new distribution start.
MikeHathaway marked the issue as sponsor acknowledged
Downgrading to Low as this seems to be the intended design: there is indeed a logic to look back up to two previous distribution periods
Picodes changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L119-L164 https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L197-L220
Vulnerability details
Impact
When
block.number
is more than the end block of the current distribution period and less than the end block of the challenge stage for the current distribution period, the followingStandardFunding.startNewDistributionPeriod
function can be called to start a new distribution period. In this case, becauseblock.number > _getChallengeStageEndBlock(currentDistributionEndBlock)
is false,_updateTreasury(currentDistributionId)
will not be executed. Since theStandardFunding._updateTreasury
function below forcurrentDistributionId
is not called, the tokens that are not distributed during the current distribution period would not be added back totreasury
for the new distribution period. Therefore, after executinguint256 gbc = Maths.wmul(treasury, GLOBAL_BUDGET_CONSTRAINT)
andnewDistributionPeriod.fundsAvailable = SafeCast.toUint128(gbc)
in theStandardFunding.startNewDistributionPeriod
function,fundsAvailable
for the new distribution period is less than it should be comparing to the situation in which the non-distributed tokens from the current distribution period could be re-added totreasury
before starting the new distribution period. Since the proposals' tokens requested and voters' delegate rewards are limited byfundsAvailable
for the new distribution period that is less than it should be, the maximum number of tokens that can be requested by the proposals and the maximum delegate rewards that can be claimed by the voters would be less than they should be for the new distribution period, which are unfair to these proposals and voters.https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L119-L164
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-grants/src/grants/base/StandardFunding.sol#L197-L220
Proof of Concept
The following steps can occur for the described scenario.
block.number
is more than the end block of the current distribution period and less than the end block of the challenge stage for the current distribution period.StandardFunding.startNewDistributionPeriod
function is called to start the new distribution period._updateTreasury(currentDistributionId)
is not executed, the 1e24 tokens that were not distributed during the current distribution period are not added back totreasury
for the new distribution period.GLOBAL_BUDGET_CONSTRAINT
is0.03 * 1e18
, executinguint256 gbc = Maths.wmul(treasury, GLOBAL_BUDGET_CONSTRAINT)
andnewDistributionPeriod.fundsAvailable = SafeCast.toUint128(gbc)
would causefundsAvailable
for the new distribution period to be1e24 * 0.03 = 3e22
tokens less than it should be.Tools Used
VSCode
Recommended Mitigation Steps
The
StandardFunding.startNewDistributionPeriod
function can be updated to revert ifblock.number
is still less than or equal to the end block of the challenge stage for the current distribution period. If using this approach, the new distribution period can only be started after the challenge stage for the current distribution period is ended.Assessed type
Other