The Standard

Summary

distributeAssets in LiquidationPool.sol lack of access control , attacker can invoke this function to add native token reward and claim those reward by invoking claimRewards

Vulnerability Details

anyone could invoke runLiquidation in LiquidationPoolManager.sol to liquidate specific tokenId. If the liquidation is successful, these tokens will be sent to the LiquidationPoolManager. And LiquidationPoolManager invoke pool.distributeAssets():

This function will increase the value in the staker's rewards mapping

Finally those position holders can invoke claimRewards to get their reward tokens.
Note that those reward tokens will remain in the pool until position holders invoke the claimRewards function.
Assuming there are 5 ether native tokens remaining in the pool.
Thus, the attacker can directly invoke distributeAssets and pass in specific parameters.
Even though this function would invoke returnUnpurchasedNative to return back those unpurchased native token to manager , attacker can set the value of _hundredPC to ZERO, this way, all the amounts will be allocated, resulting in no remaining native tokens to be returned to the manager.

Here is my test written using foundry

we can run this test with a arb-mainnet fork:

output:

We can see that Alice, by calling this function, obtains the remaining native tokens in the pool that other players have not claimed in a timely manner.

Impact

The attacker can steal the remaining native tokens in the pool.

Tools Used

Founry

Recommendations

recommand to add access control to distributeAssets in LiquidationPool.sol