Closed code423n4 closed 1 year ago
ith-harvey marked the issue as sponsor disputed
ith-harvey marked the issue as sponsor disputed
The issue listed in their C4 issue is invalid. They make the claim that if totalBurnedLatest
< totalBurnedAtBlock
there would be a revert. This is not possible in the code as the amount burned returned from burnInfo()
call to the pool is always an increasing number.
Picodes marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L679 https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L693-L731 https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L697 https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/RewardsManager.sol#L653-L655
Vulnerability details
Impact
_updateBucketExchangeRates will not work correctly and would revert in case totalBurnedLatest < totalBurnedAtBlock causing DOS for the users when they try to claimRewards, moveStakedLiquidity, stake or unstake.
Proof of Concept
When the curBurnEpoch doesn't not equal zero at _updateBucketExchangeRates function at L679 will jump to else block and execute those lines L693-L731
So basically the code block above is calculating the rewardsCap and rewardsClaimedInEpoch, updating the total tokens claimed for bucket exchange rates with accumulating the full amount of additional rewards. Now the issue case is happening when totalBurned value is returned by _getPoolAccumulators function on L697
The totalBurned is being calculated at L653-L655
Since totalBurnedLatest is starting from zero, It is possible that totalBurned of current block (totalBurnedLatest) is less than totalBurned of previous block (totalBurnedAtBlock) resulting in a revert.
Note: this also applicable on totalInterest
Tools Used
Manual Review
Recommended Mitigation Steps
Check if totalBurnedLatest greater than totalBurnedAtBlock for the totalBurned, Also do the same for totalInterest.
Assessed type
DoS