The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Rebasing tokens can cause issues to the `LiquidityPool` contract

DarkTower

Summary

Rebasing tokens can cause issues to the LiquidityPool contract. Which can lead to discrepancies between the balance of the contract and the internal accounting, potentially resulting in users being unable to claim their rewards and tokens getting stuck in the contract.

Vulnerability Details

The vulnerability arises from the way the LiquidityPool contract handles rewards for rebasing tokens. Rebasing tokens can change their balance in a user's account without a transfer event, leading to inconsistencies between the actual token balance in the contract and the internally tracked reward amounts.

Ultimately, this can lead to a point where some users will be unable to withdraw their rewards because contract lacks the funds.

function claimRewards() external {
ITokenManager.Token[] memory _tokens = ITokenManager(tokenManager).getAcceptedTokens();
for (uint256 i = 0; i < _tokens.length; i++) {
ITokenManager.Token memory _token = _tokens[i];
uint256 _rewardAmount = rewards[abi.encodePacked(msg.sender, _token.symbol)];
if (_rewardAmount > 0) {
delete rewards[abi.encodePacked(msg.sender, _token.symbol)];
if (_token.addr == address(0)) {
(bool _sent,) = payable(msg.sender).call{value: _rewardAmount}("");
require(_sent);
} else {
@> IERC20(_token.addr).transfer(msg.sender, _rewardAmount);
}
}
}
}

And the remaining tokens, will be forever stuck in the contract.

Impact

  • The actual balance of the token in the contract might be lower than the recorded total rewards

  • Some users may not be able to claim their rewards if the actual token balance is lower than the internally tracked amount

  • Locked funds

Tools Used

Manual review

Recommandation

Disallow such tokens

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.