Submitted by adriro, also found by HChang26
Rewards are set up using protocol commands, but its entry point is not payable.
Rewards can be set up by protocol authorities using the functions setConcRewards() and setAmbRewards() present in the LiquidityMiningPath contracts. These two are part of the command pattern used in the protocol: the main entry point receives commands which are then routed to the proper place using codes.
The protocol command flow starts at the CrocSwapDex contract:
https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/CrocSwapDex.sol#L103-L106
https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/mixins/ProxyCaller.sol#L22-L28
The protocolCmd() function checks the call is properly authorized and calls callProtocolCmd(), which then executes a delegatecall to the corresponding implementation, in this case the LiquidityMiningPath contract:
https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/callpaths/LiquidityMiningPath.sol#L26-L37
While CrocSwapDex::protocolCmd() is payable, its counterpart in LiquidityMiningPath is not. This means that rewards cannot be transferred while setting them up, rejecting any command that has positive callvalue.
Make LiquidityMiningPath::protocolCmd() payable.
Payable
141345 (lookout) commented:
OpenCoreCH (Canto) confirmed
