Possible to mint or burn infinite shares, stealing all rewards or making transfers fail
Description
Increasing shares infinitely allows an attacker to steal all rewards. It's possible by doing:
- In _isExcludedFromRewards(), the condition addr.code.length > 0 && !isOptin[addr] will return false if the contract is in the constructor, enabling - 1. transfer Trestle no a new contract, 2. after the constructor, move the funds to another address, which won't reduce shares as the contract has not opted in.
- Calling rewardOptIn() with a blacklisted address will increase shares infinitely as _isExcludedFromRewards() will always return true, increasing shares every time (not possible anymore as addresses can not be blacklisted post dead block period).
- Removing from the blacklist a smart contract that has not opted in will keep increasing shares every time, as _isExcludedFromRewards() will always return true. Decreasing shares to 0 will mean reward eligible accounts (EOAs or smart contracts that have opted in) with previous non 0 balance will always revert when transferring shares (either from or to). It's possible to do this in the 2 following aways:
- rewardOptout() will keep decreasing shares if called by an EOA or in the constructor of a smart contract, as _isExcludedFromRewards() will always return false.
- _addToBlacklist() will keep decreasing shares if addr is an EOA or a smart contract that has opted in, as will always return false (not possible anymore as the dead block period is over).
Status
Infinite shares addressed by disabling