The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Modifying the pool fee percentage can break the fee distribution mechanism

zigtur

Summary

Pool fee percentage can be set to a value that will break the fee distribution mechanism.

Vulnerability Details

The owner of the LiquidationPoolManager can modify the poolFeePercentage through the
setPoolFeePercentage function. The poolFeePercentage is then used in thedistributeFees
function to calculate the amount of tokens to send to the LiquidationPool.

If poolFeePercentage > HUNDRED_PC, then the amount to send to the LiquidationPool will be greater
than the current balance of the LiquidationPoolManager. Then during the call to the LiquidationPool,
safeTransferFrom will revert and fees will not be distributed.

Impact

Denial of service of fee distribution

Tools Used

Scope:
Scope:

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L84-L86

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L35

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPoolManager.sol#L38

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L185

PoC - Unit Test

The following unit test shows the vulnerability.

describe('zigturExploit', async () => {
it('Modifying the pool fee percentage can break the fee distribution mechanism', async () => {
// getTstTotal() must be greater than 0
const tstPosition1Value = ethers.utils.parseEther('1250');
let poolTSTTotal = tstPosition1Value;
await TST.mint(holder1.address, poolTSTTotal);
await TST.connect(holder1).approve(LiquidationPool.address, tstPosition1Value)
await LiquidationPool.connect(holder1).increasePosition(tstPosition1Value, 0);
​
// Vulnerability
const newPoolFeePercentage = 100001; // greater than 100000
await LiquidationPoolManager.setPoolFeePercentage(newPoolFeePercentage);
​
const feeBalance = ethers.utils.parseEther('1000');
await EUROs.mint(LiquidationPoolManager.address, feeBalance);
// Must revert
await expect(LiquidationPoolManager.distributeFees()).to.be.revertedWith('ERC20: transfer amount exceeds balance');
});
});

Recommendations

Consider checking that the _poolFeePercentage <= HUNDRED_PC in the setPoolFeePercentage function.

This can be done by replacing the setPoolFeePercentage function by the following code:

function setPoolFeePercentage(uint32 _poolFeePercentage) external onlyOwner {
require(_poolFeePercentage <= HUNDRED_PC, "incorrect percentage");
poolFeePercentage = _poolFeePercentage;
}
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.