The Standard

Summary

The LiquidationPool smart contract contains a vulnerability in the distributeAssets function. This function, which lacks proper access controls, can be exploited by attackers to manipulate contract rewards and burn euros in the contract by craft malicious assets input.

Vulnerability Details

The distributeAssets function, designed to be called by LiquidationPoolManager during runLiquidation, can be accessed by anyone due to missing access controls. Attackers can exploit this by crafting a fake assets[] array with a controlled token, deceiving the contract into recognizing it as a legitimate asset.

Think about the following scenerio:

• Attacker craft a fake assets[] with his own controlled token("malToken") as the input to call distributeAssets and disguising it with the symbol of a valuable asset in the contract (e.g., USDC).

• Inside the invocation, the reward linked to the USDC will be updated( since the contract using symbol instead of the token address)

• Because the malToken(asset.token.addr) is controlled by attacker, the fake token transfer will be successful

Impact

• reward can be manipulated

• Euros in the contract can be burned

Tools Used

Manual

Recommendations

Adding access control to distributeAssets.