Submitted by oakcobalt, also found by 0xAlix2, 0xlookman, Bauchibred, Egis_Security, gegul, jasonxiale, Lambda, and Tigerfrake
The penalty fee is a percentage of the value of existing positions that are emergency withdrawn (withdraw_position). It is shared equally among farm owners whose farms have the same lp_denom as the position.
The vulnerability is that the penalty fee is divided amongst all farms regardless of whether the farms are current, in the future, or already expired, which allows malicious farm owners to exploit.
We see in withdraw_position, all farms with the same lp_denom are fetched to get farm owners to share penalty fees. And get_farms_by_lp_denom fetches all farms indexed by lp_denom regardless whether the farm is current, in the future or already expired.
/contracts/farm-manager/src/position/commands.rs#L366-L368
/contracts/farm-manager/src/state.rs#L124
Suppose a malicious farm creator creates a future farm with valid assets and a popular lp_denom with one existing farm active. The new farm is valid in the eyes of admin due to the farm has sufficient assets and correct epoch settings.
Active farm owners get less penalty fee shares due to fee shared among expired farms and future farms. A malicious farm creator could also take penalty fee shares without having to contribute to rewarding.
In withdraw_position, before dividing the owner_penalty_fee_comission, filter out farms that starts in a future epoch or have expired.
jvr0x (MANTRA) confirmed and commented:
3docSec (judge) commented:
