XDZIBEC - XO- `Unchecked` Completion in `_complete()` Function Enables Rewards Theft

[sherlock-admin]

XDZIBEC

high

XO- Unchecked Completion in _complete() Function Enables Rewards Theft

Summary

• The vulnerability make the function does not validate the programId parameter, allowing an attacker to call the _complete() function with an invalid programId. As a result, the function completes a program that doesn't exist, this lead to steal token from users.

  Vulnerability Detail

  */
  function _complete(
      ProductManager storage self,
      IProduct product,
      uint256 programId
  ) internal returns (uint256 versionComplete) {
      versionComplete = self.programs[programId].complete(product, self.programInfos[programId]);
      self.activePrograms.remove(programId);
  }
  /*

• There is s a vulnerability in the _complete function, the issue is that this line
  versionComplete = self.programs[programId].complete(product, self.programInfos[programId]); does not check to see if the programId is valid, means that an attacker could call the _complete() function with an invalid programId, and the function would complete a program that does not exist.

  Impact

• An attacker could create an invalid programId and then call the _complete() function with that invalid programId. The function would then complete the invalid program, which would allow the attacker to steal rewards from the contract.
• An attacker could manipulate the market to create an invalid programId. For example, the attacker could buy up all of the tokens for a particular program, which would effectively make the program invalid. The attacker could then call the _complete() function with the invalid programId and steal rewards from the contract.

  Code Snippet

• https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial/contracts/incentivizer/types/ProductManager.sol#L194C5-L204C8

  Tool used

Manual Review

Recommendation

• adding require(valid(self, programId)); to the _complete() function,this can help to ensure that the function is effective and that it cannot be bypassed by an attacker.