Staked Credit Rewards can be unfairly divided because of MEV/Just-in-time deposits

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/governance/ProfitManager.sol#L292

Vulnerability details

Vulnerability details

An attacker can use MEV (via gas auction or Flashbots or control of miners) to cause an unfair division of rewards. By providing a large (relative to the size of all other staked tokens) credit token deposit Just-in-Time before a GAUGE_PNL_NOTIFIER call to ProfitManager.notifyPnL the CREDIT deposited by the attacker will receive a big portion of the rewards and the attacker can immediately withdraw their deposit after rewards are distributed.

We assume this allows an attacker to get a lot of the rewards (in GUILD and CREDIT) even though they haven't provided any deposit that has been borrowed.

Impact

Credit holders get rewards, they have not earned

Proof of Concept

1. An attacker watches the mempool for calls to ProfitManager.notifyPnL by the GAUGE_PNL_NOTIFIER role.
2. The attacker orders the block's transactions (most easily using a flashbots bundle) in the following order:
   1. Attacker deposits assets to lend (ideally the pool will be the one with the least volume).
   2. GAUGE_PNL_NOTIFIER call to ProfitManager.notifyPnL happens
   3. Attacker withdraws their deposit.

Tools Used

Manual review

Recommended Mitigation Steps

A good mitigation approach could use something like snapshotting who has deposited since the last reward distribution and only give these depositors rewards based on the size of their deposits the next time yield is distributed.

Assessed type

MEV

[c4-pre-sort]

0xSorryNotSorry marked the issue as sufficient quality report

[c4-pre-sort]

0xSorryNotSorry marked the issue as duplicate of #1173

[c4-judge]

Trumpero marked the issue as not a duplicate

[c4-judge]

Trumpero marked the issue as duplicate of #994

[c4-judge]

Trumpero marked the issue as unsatisfactory:
Invalid

[c4-judge]

Trumpero marked the issue as satisfactory