MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Distribution contract owner can ruin rewards for some users

vladzaev

Summary

Distribution contract owner can ruin rewards for some users while managing users in private pools

Vulnerability Details

Contract owner can call manageUsersInPrivatePool() to manage users accounts in private pools:

function manageUsersInPrivatePool(
uint256 poolId_,
address[] calldata users_,
uint256[] calldata amounts_
) external onlyOwner poolExists(poolId_) {
require(!pools[poolId_].isPublic, "DS: pool is public");
require(users_.length == amounts_.length, "DS: invalid length");
​
uint256 currentPoolRate_ = _getCurrentPoolRate(poolId_);
​
for (uint256 i; i < users_.length; ++i) {
address user_ = users_[i];
uint256 amount_ = amounts_[i];
​
uint256 deposited_ = usersData[user_][poolId_].deposited;
​
if (deposited_ < amount_) {
_stake(user_, poolId_, amount_ - deposited_, currentPoolRate_);
} else if (deposited_ > amount_) {
_withdraw(user_, poolId_, deposited_ - amount_, currentPoolRate_);
}
}
}
​

Take a look on the last lines where code should choose to stake or withdraw assets for the user. If the ammount is higher than deposited one, it forwards a call to stake, in other case - to withdraw.

So it is not possible to add an amount (make a deposit for users) if amount is less than deposited.

Imagine the sitaution when user ask to deposit 500 tokens for him (and he has 1000 deposited token already). In that case contract owner will withdraw assets despite on a user wish. A user will also loose his rewards for a full amount.

Impact

Users can be forced to withdraw assets by contract owner and loose some rewards

Tools Used

Manual review.

Recommendations

Not sure about the right purpose of that functions, but I guess it's better to add a flag for managing assets flow for contract owner. It can be a bool value deposit / withdraw to make it more easy to navigae inside manageUsersInPrivatePool.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.