Error in if operation causes malfunction in all contract logic

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L176 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L94 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L166

Vulnerability details

Impact

The operation performed in if(timeSinceLastDistribution >= VESTING_PERIOD) should be the other way around, since timeSinceLastDistribution = block.timestamp - lastDistributionTimestamp;

Proof of Concept

therefore example:

• If the last transfer is made (L94 at 9am) that will be valid lastDistributionTimestamp.
• At 11am getUnvestedAmount() is executed, timeSinceLastDistribution = 11 - 9 = 2 hours.
• Since 2 hours is not >= VESTING_PERIOD, since it is 8 hours, the if will not be executed and it will jump to executing L180.

Therefore, it will be allowed to withdraw assets without the need to respect the vesting.

In contrast, if no operation is performed to modify lastDistributionTimestamp and 8 hours pass, the following will happen:

• If the last transfer is made (L94 at 9am) that will be valid lastDistributionTimestamp.
• At 8pm getUnvestedAmount() is executed, timeSinceLastDistribution = 20 - 9 = 11 hours.
• Since 11 >= VESTING_PERIOD, it will always return 0 and therefore you will never be able to withdraw assets in transferInRewards(L89)

and also the function totalAssets(L166) will give an incorrect value of the state.

The L180 VESTING_PERIOD - timeSinceLastDistribution operation is possibly also wrong.

Recommended Mitigation Steps

In L176 the following if (timeSinceLastDistribution <= VESTING_PERIOD) should be performed.

Assessed type

Invalid Validation

[raymondfam]

Everything is working as intended. (timeSinceLastDistribution <= VESTING_PERIOD) would make totalAssets() release all vested tokens though, facilitating users frontrunning the payment of yield.

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory: Invalid