The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Lack of access control for the distributeAssets function.

gkrastenov

Summary

Lack of access control for the distributeAssets function.

Vulnerability Details

A malicious user can manipulate the _collateralRate, _hundredPC, and _assets.amount variables to adjust the values of _portion and costInEuros. The _portion can easily be set to be equal to 1, and costInEuros can be set to be greater than _portion.

uint256 _portion = asset.amount * _positionStake / stakeTotal;`
​
uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;

This will lead the if statement if (costInEuros > _position.EUROs) to be true and costInEuros will be set to _position.EUROs. Consequently, the holder's position will be decreased by costInEuros.

_position.EUROs -= costInEuros; // losing all euros

As a result, the holders will lose their EUROs and the reward received will be a very low amount.

Impact

Holders will lose their EUROs.

Tools Used

Manual Review

Recommendations

Add an access modifier for the distributeAssets function to be called only by the manager.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

precision

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.