The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

distributeAssets : whale user can influence the asset distribution based on the their staked value.

ak1

Summary

Whale user influence the asset distribution.

Vulnerability Details

when liquidation happens, the assets are distributed based on the amount of is staked. This is done by calling the function distributeAssets.
This function traverse all the all the holder's position and compute the amount of shared based on each holder's staked amount.

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L211-L234

for (uint256 j = 0; j < holders.length; j++) {
Position memory _position = positions[holders[j]];
uint256 _positionStake = stake(_position);
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
uint256 _portion = asset.amount * _positionStake / stakeTotal;
uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;
if (costInEuros > _position.EUROs) {
_portion = _portion * _position.EUROs / costInEuros;
costInEuros = _position.EUROs;
}
_position.EUROs -= costInEuros;
rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion; -------->> shares is awarded in the form of rewards
burnEuros += costInEuros;
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
}
}

The shares is awarded in the forms of reward. this can be claimed later,

Impact

Large amount of rewards can be taken out by the whale user. They will deposit huge sum an withdraw shortly. The delay period is one day.
An user who has staked from beginning will gets impacted.

Tools Used

Manual review.

Recommendations

The fix would need major changes in the staking process.

one possible solution is to use time weighted average of staked portion when calculating the rewards.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

distributeAssets-issue

ak1 Submitter
over 1 year ago

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.