When PendlePowerFarmToken contract is deployed in the PendlePowerFarmTokenFactory contract in PendlePowerFarmTokenFactory.deploy(), it creates a new PendlePowerFarmToken contract and calls the initialize() function.
This action would inadvently create an opportunity for a malicious user monitoring the network and observed the PendlePowerFarmToken contract deployment to take advantage of the error to manipulate totalLpAssetsToDistribute and other state variables.
Tools Used
Manual
Recommended Mitigation Steps
apply a zero address check to ensure the contract is not initialized with a zero address at deployment.
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmToken.sol#L682-L687 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmTokenFactory.sol#L102-L108 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmController.sol#L211-L229
Vulnerability details
Impact
When PendlePowerFarmToken contract is deployed in the PendlePowerFarmTokenFactory contract in
PendlePowerFarmTokenFactory.deploy()
, it creates a new PendlePowerFarmToken contract and calls theinitialize()
function.The initialize() function in PendlePowerFarmToken initializes the
PENDLE_MARKET
,PENDLE_CONTROLLER
,MAX_CARDINALITY
,_name
,_symbol
,PENDLE_POWER_FARM_CONTROLLER
,UNDERLYING_PENDLE_MARKET
,and other state variables. https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmToken.sol#L682-L732However, due to a missing a zero address check, it may be possible to re-initialize the state variables of PendlePowerFarmToken contract.
This is possible if the master address of the PNEDLE_POWER_FARM_CONTROLLER contract mistakenly calls
PendlePowerFarmController.addPendleMarket()
with a zero address as the_pendleMarket
parameter https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmController.sol#L211-L229This action would inadvently create an opportunity for a malicious user monitoring the network and observed the PendlePowerFarmToken contract deployment to take advantage of the error to manipulate
totalLpAssetsToDistribute
and other state variables.Tools Used
Manual
Recommended Mitigation Steps
apply a zero address check to ensure the contract is not initialized with a zero address at deployment.
Assessed type
Other