Liquid Staking

Summary
The distributeRewards function in the RewardsPool contract lacks proper access control, allowing any external account to trigger reward distribution. This vulnerability could lead to unauthorized manipulation of the reward system, potentially disrupting the tokenomics and trust in the platform.

Vulnerability Details

The distributeRewards function is designed to distribute new rewards that have been deposited into the contract. However, the function does not implement any access control mechanisms. As demonstrated by the passing test case:

This test shows that an unauthorized account (signers[5]) can successfully call the distributeRewards function, resulting in the distribution of rewards.

Impact

The lack of access control on the distributeRewards function can have several severe consequences:

• Unauthorized Reward Distribution: Malicious actors can trigger reward distributions at will, potentially disrupting the intended reward schedule.

• Economic Manipulation: Attackers could time their calls to distributeRewards to benefit certain users unfairly or to manipulate token prices.

• Denial of Service: Continuous calling of this function by bots or malicious actors could lead to unnecessary gas costs and network congestion.

• Loss of Trust: Users may lose confidence in the platform if they perceive that the reward system can be manipulated by unauthorized parties.

Tools Used

Manual

Recommendations

To address this vulnerability, consider implementing the following changes:

1. Add Access Control

2. Use a Time-Lock Mechanism