Brokkr Protocol P3 Contracts - Brokkr

The rewards contract has a spend_limit attribute that caps the maximum amount a distributor can spend in a transaction. However, the amount of each distribution message is verified separately instead of checking that the global amount spent is less than the spending limit. That allows a distributor to bypass the restriction in a transaction.

Users who interact with the distribute function must be whitelisted first. Therefore, the likelihood of such a scenario is low.

Code Location

contracts/rewards/src/commands.rs,

let mut msgs: Vec<CosmosMsg> = vec![];
for distribution in distributions {
    if config.spend_limit < distribution.amount {
        return Err(ContractError::SpendLimitReached {});
    }

    msgs.push(CosmosMsg::Wasm(WasmMsg::Execute {
        contract_addr: bro_token.clone(),
        funds: vec![],
        msg: to_binary(&Cw20ExecuteMsg::Send {
            contract: distribution.contract,
            amount: distribution.amount,
            msg: distribution.msg,
        })?,

SOLVED: The issue was fixed in commit a9856345f269ca5275236297feae192d1ee4cec4.

When updating the epoch manager status, the owner can set the following attributes:

• epochs (number of blocks in an epoch)
• blocks_per_year
• bbro_emission_rate

The absence of validation allows the variables to be set to 0, inducing malfunction in the contracts by querying the epoch-manager: staking-v1 and distributor-v1. For example, epochs with a value of 0 will cause a 0-unverified division in the distributor-v1 contract, and a 0-verified division in the staking-v1 contract, causing transactions to go into panic.

However, only an administrator can update these values. Therefore, the likelihood is limited.

Code Location

Absence of validation when updating the state value in epoch-manager:

contracts/epoch-manager/src/commands.rs,

let mut state = load_state(deps.storage)?;

if let Some(epoch) = epoch {
    state.epoch = epoch;
}

if let Some(blocks_per_year) = blocks_per_year {
    state.blocks_per_year = blocks_per_year;
}

if let Some(bbro_emission_rate) = bbro_emission_rate {
    state.bbro_emission_rate = bbro_emission_rate;
}

store_state(deps.storage, &state)?;

\color{black}\color{white}In staking-v1, when calling compute_normal_bbro_reward:

contracts/staking-v1/src/state.rs,

let epoch_info = query_epoch_info(querier, epoch_manager_contract)?;

let epochs_staked = Uint128::from(state.last_distribution_block - self.last_balance_update)
    .checked_div(Uint128::from(epoch_info.epoch))?;

\color{black}\color{white}In distributor, when calling distribute:

contracts/distributor-v1/src/commands.rs,

// query epoch from epoch_manager contract
let epoch_blocks = query_epoch_info(
    &deps.querier,
    deps.api.addr_humanize(&config.epoch_manager_contract)?,
)?
.epoch;

// distribute rewards only for passed epochs
let blocks_since_last_distribution = env.block.height - state.last_distribution_block;
let passed_epochs = blocks_since_last_distribution / epoch_blocks;
if passed_epochs == 0 {
    return Err(ContractError::NoRewards {});
}

SOLVED: The issue was fixed in commit 1c7ab7d56ae6ad16c88d8fdfeddb4e3e8e571f85.