Submitted by NentoR, also found by NentoR and 00xSEV
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmToken.sol#L98-L130
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmToken.sol#L502-L524
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmToken.sol#L89-L95
Random actors, malicious or not, can DOS the Pendle PowerFarm vault by sending rewards to it through PendlePowerFarmToken::addCompoundRewards() or PendlePowerFarmController::exchangeRewardsForCompoundingWithIncentive(). This results in all users being unable to access their positions or open new ones for a set amount of time imposed by PendlePowerFarmToken::_validateSharePriceGrowth().
The PendlePowerFarmToken has a mechanism in place that protects the vault from people looping and increasing the share price:
This is a private function invoked from the syncSupply() modifier, which is used for the following functions:
The entry point of this exploit is addCompoundRewards():
We can see that it allows users to donate their tokens to the vault to increase the totalLpAssetsToDistribute. This is then distributed among holders with subsequent calls to the aforementioned functions.
This is the code for the syncSupply() modifier:
The problem here is that even though addCompoundRewards() calls it, the rewards added do not affect the share price immediately. Its still the previously deposited amount. So, the condition _sharePriceNow > maximum holds true at the time someone calls addCompoundRewards() but causes a revert with subsequent calls to functions dependent on the modifier until enough time passes for the condition to hold true again.
Coded POC (PendlePowerFarmControllerBase.t.sol):
I recommend turning the deposited rewards into shares at the time of calling addCompoundRewards(), so we can get _validateSharePriceGrowth() to validate it immediately and revert on the spot if needed. This will prevent the DOS and share price growth manipulation.
DoS
Trust (judge) increased severity to High and commented:
vm06007 (Wise Lending) commented:
vm06007 (Wise Lending) commented:
Trust (judge) commented:
Alex the Entreprenerd (Appellate Court judge) commented:
Trust (judge) commented:
Wise Lending commented:
Note, this finding was downgraded to Medium by C4 staff in reference to the Appellate Court decision.
