TempleGold

Summary

The function setDistributionParams is intended to ensure that the sum of the distribution percentages for staking, gnosis, and escrow add up to 100%. However, the code only checks if the sum is equal to DISTRIBUTION_DIVISOR, which is set to 100 ether. This creates a potential issue where the distribution parameters can be incorrectly validated if the inputs are not properly scaled.

Vulnerability Details

https://github.com/Cyfrin/2024-07-templegold/blob/57a3e597e9199f9e9e0c26aab2123332eb19cc28/protocol/contracts/templegold/TempleGold.sol#L120C1-L124C6

The check _params.staking + _params.gnosis + _params.escrow != DISTRIBUTION_DIVISOR only verifies if the sum of the input parameters equals DISTRIBUTION_DIVISOR. It does not ensure that these parameters are properly scaled by 1 ether, which can lead to incorrect validation.

For example, the expected inputs should be staking = 50 ether, gnosis = 30 ether, and escrow = 20 ether. If a user provides staking = 50, gnosis = 30, and escrow = 20 instead, the sum would be 100, which satisfies the current validation check but does not match the required scaling.

Impact

Incorrect Token Distribution:

• Disproportionate Rewards: The minting process could distribute tokens disproportionately if the parameters are not properly scaled. For example, a distribution parameter of 50 instead of 50 ether would drastically reduce the number of tokens allocated for staking, gnosis, and escrow.

• Economic Imbalance: This can lead to an economic imbalance within the ecosystem, where some entities receive far fewer tokens than intended, affecting incentives for participation.

Security Vulnerability:

• Exploitation by Malicious Actors: A malicious actor could deliberately provide incorrectly scaled parameters to manipulate the token distribution for their gain.

Tools Used

Recommendations

• Modify the validation check to ensure that the inputs are properly scaled by comparing them with DISTRIBUTION_DIVISOR multiplied by 1 ether.