The Standard

Summary

Tokens not accepted by the token manager contract can be used during the distribution of assets.

Vulnerability Details

As an input parameter, the distributeAssets function receives ILiquidationPoolManager.Asset[] memory _assets, which contains information about the token address, token decimals, token symbols and token amount. If the _assets array contains a token that is not accepted by the tokenManager contract, an invalid reward will be created, which cannot be claimed afterward.

rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;

Also, holders will lose their EUROs for bearing the cost.

_position.EUROs -= costInEuros;

Impact

An unclaimable reward can be created, and holders will lose their EUROs.

Tools Used

Manual Review

Recommendations

The distributeAssets function should only accept tokens that are deemed acceptable by the tokenManager contract.