0xDjango - Changes to voteFactor can lead to unclaimable tokens

[sherlock-admin2]

0xDjango

high

Changes to voteFactor can lead to unclaimable tokens

Summary

Upon initialization of a user's DistributionRecord, they are minted voting power based on the current voteFactor value. Upon claiming tokens, their voting power is burned based on the current votefactor. Therefore, if the voteFactor were to increase between these actions by calling setVoteFactor(), users would not be able to claim their full amount of tokens.

Vulnerability Detail

Users receive voting power when their DistributionRecord is initialized:

  function _initializeDistributionRecord(
    address beneficiary,
    uint256 totalAmount
  ) internal virtual override {
    super._initializeDistributionRecord(beneficiary, totalAmount);


    // add voting power through ERC20Votes extension
    _mint(beneficiary, tokensToVotes(totalAmount));
  }

This mints voting power as a function of the current voteFactor value:

  function tokensToVotes(uint256 tokenAmount) private view returns (uint256) {
    return (tokenAmount * voteFactor) / fractionDenominator;
  }

When the user claims their tokens, their voting power is burned based on the same tokensToVotes calculation. Therefore, any increase in vote factor will lead to unclaimable funds.

  function _executeClaim(
    address beneficiary,
    uint256 totalAmount
  ) internal virtual override returns (uint256 _claimed) {
    _claimed = super._executeClaim(beneficiary, totalAmount);


    // reduce voting power through ERC20Votes extension
    _burn(beneficiary, tokensToVotes(_claimed));
  }

Impact

• Frozen airdrops due to underflow

Code Snippet

https://github.com/sherlock-audit/2023-06-tokensoft/blob/main/contracts/contracts/claim/abstract/AdvancedDistributor.sol#L73-L95

Tool used

Manual Review

Recommendation

The lengthy and expensive mitigation would involve keeping a record of holders and mint/burn them a proportional amount of voting power in case the voteFactor changes.

Final note

Oppositely, if the voteFactor were to decrease, the token claim would succeed but user's would retain voting power after claiming their entire distribution. All this to say, any change to the voteFactor leads to undesirable circumstances without accounting for the change in the existing voting power balances.

Duplicate of #55