`liquidityFacet`: fenwick tree attack through multiple deposits

Impact: Medium

Likelihood: Medium

In the current implementation of the addLiquidity() function, a malicious user can exploit the Fenwick Tree structure by adding liquidity multiple times on behalf of another user, effectively filling the tree and potentially preventing legitimate deposits from occurring. The Fenwick Tree has a maxDepositEntries limit, and once this limit is reached, no more entries can be added. This enables griefing behavior, where an attacker could manipulate the system by adding multiple deposits for a single user, thus locking out legitimate users from depositing liquidity until the tree is reset.

    function _deposit(FenwicksData storage self, uint256 maxDepositEntries, uint256 lockDuration, uint256 amount)
        internal
    {
        uint256 treeIndex = _registerKey(self, maxDepositEntries, block.timestamp + lockDuration);
        _fenwicksUpdate(self, maxDepositEntries, treeIndex, amount);
        self.totalMintedPLP += amount;
    }

    function _registerKey(FenwicksData storage self, uint256 maxDepositEntries, uint256 newTimestamp)
        internal
        returns (uint256 treeIndex)
    {
        uint256 keyCount = self.sortedKeys.length;

@>      if (keyCount >= maxDepositEntries) revert Fenwicks_TooManyKeys();

        self.sortedKeys.push(newTimestamp);
        self.keyToIndex[newTimestamp] = ++keyCount;

        treeIndex = self.keyToIndex[newTimestamp];
    }

Although users can withdraw all liquidity to reset the tree, this action can only be performed after the lock duration has passed, which may lead to prolonged periods where malicious behavior can persist.

Check msg.sender in add liquidity to prevent unauthorized access.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.