The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

DoS Risk: Malicious LiquidationPoolManager Owner can set bad value poolFeePercentage to disturb the distributeFees function

dianivanov

Summary

A malicious owner of LiquidationPoolManager contract can initiate a Denial of Service (DoS) attack on the distributeFees function. This is possible if the owner of the LiquidationPoolManager contract manipulates the poolFeePercentage to exceed the maximum limit defined by HUNDRED_PC (100%, or 1e5). Such an action can disrupt the normal function execution of distributeFees.

Vulnerability Details

If distributeFees is more than HUNDRED_PC the _feesForPool variable will have value more than the actual balance of EUROs of the contract. Because of that the transfer call after that will fail.

function distributeFees() public {
IERC20 eurosToken = IERC20(EUROs);
uint256 _feesForPool = eurosToken.balanceOf(address(this)) * poolFeePercentage / HUNDRED_PC;
if (_feesForPool > 0) {
eurosToken.approve(pool, _feesForPool);
LiquidationPool(pool).distributeFees(_feesForPool);
}
eurosToken.transfer(protocol, eurosToken.balanceOf(address(this)));
}

The following test in liquidityPoolManager.js demonstrates a reverting distributeFees call (copied from 'distributes % of accrued EUROs fees to the pool stakers' and just injected the setter in question):

it('Failed distribution because of malicious owner', async () => {
const tstPosition1Value = ethers.utils.parseEther('1250');
let poolTSTTotal = tstPosition1Value;
await TST.mint(holder1.address, poolTSTTotal);
await TST.connect(holder1).approve(LiquidationPool.address, tstPosition1Value)
await LiquidationPool.connect(holder1).increasePosition(tstPosition1Value, 0);
...
const feeBalance = ethers.utils.parseEther('1000');
await EUROs.mint(LiquidationPoolManager.address, feeBalance);
​
//Malicous owner sets the fee percentage to be more than 100001
await LiquidationPoolManager.setPoolFeePercentage(100001);
await expect(LiquidationPoolManager.distributeFees()).to.be.reverted;
...
}

Impact

The distributeFees function is unable to perform, the protocol fees can not be collected also the function runLiquidation can not be performed.

Tools Used

Manual review and hardhat

Recommendations

Set some limits to poolFeePercentage state variable, values like 0 and exactly HUNDRED_PC are not recommended, because if it equals 0 the fees will always be 0 and if it equals HUNDRED_PC the fee will be equal to the whole balance.

function setPoolFeePercentage(uint32 _poolFeePercentage) external onlyOwner {
if(poolFeePercentage != 0 && poolFeePercentage < HUNDRED_PC) {
poolFeePercentage = _poolFeePercentage;
}
}
Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!