## Summary When a reward token is removed from a Folio using the `remove_reward_token` function, the token is properly removed from the `FolioRewardTokens` account's tracking list and added to the disallowed tokens list. However, the associated `RewardInfo` account that was created when the token was added remains on the blockchain, becoming orphaned. This leads to locked rent (SOL) and data inconsistency. ## Finding Description The `remove_reward_token` function in the Folio protocol is designed to remove a reward token from tracking and add it to a disallowed list. However, it fails to close the associated `RewardInfo` account that was created when the token was added. This results in orphaned accounts that permanently lock SOL (rent) and create data inconsistency. In `programs/folio/src/instructions/stake/remove_reward_token.rs`, the handler function only updates the `FolioRewardTokens` account but does not close the `RewardInfo` account: ```rust pub fn handler<'info>(ctx: Context<'_, '_, 'info, 'info, RemoveRewardToken<'info>>) -> Result<()> { let folio = ctx.accounts.folio.load()?; ctx.accounts.validate(&folio)?; ctx.accounts .folio_reward_tokens .load_mut()? .remove_reward_token(&ctx.accounts.reward_token_to_remove.key())?; emit!(RewardTokenRemoved { reward_token: ctx.accounts.reward_token_to_remove.key(), }); Ok(()) } ``` The `RemoveRewardToken` struct does not include the `RewardInfo` account: ```rust pub struct RemoveRewardToken<'info> { pub system_program: Program<'info, System>, /// The executor #[account(mut)] pub executor: Signer<'info>, /// CHECK: Is the PDA of the governance account that represents the folio owner (should be signer) #[account(signer)] pub folio_owner: UncheckedAccount<'info>, #[account( seeds = [ACTOR_SEEDS, folio_owner.key().as_ref(), folio.key().as_ref()], bump = actor.bump, )] pub actor: Account<'info, Actor>, #[account()] pub folio: AccountLoader<'info, Folio>, #[account(mut, seeds = [FOLIO_REWARD_TOKENS_SEEDS, folio.key().as_ref()], bump )] pub folio_reward_tokens: AccountLoader<'info, FolioRewardTokens>, #[account()] pub reward_token_to_remove: Box>, } ``` In contrast, other parts of the codebase properly close accounts. For example, in `programs/folio/src/instructions/stake/add_reward_token.rs` the `close_user_pending_token_amount` function: ```rust pub fn handler<'info>( ctx: Context<'_, '_, 'info, 'info, CloseUserPendingTokenAmount<'info>>, ) -> Result<()> { ctx.accounts.validate()?; { let user_pending_basket = &mut ctx.accounts.user_pending_basket.load_mut()?; check_condition!(user_pending_basket.is_empty(), PendingBasketIsNotEmpty); user_pending_basket.reset(); } ctx.accounts .user_pending_basket .close(ctx.accounts.user.to_account_info())?; Ok(()) } ``` ## Impact Explanation The impact of this vulnerability is Low: - The amount of SOL locked per orphaned account is relatively small (approximately 0.00144768 SOL per account) - The protocol's core functionality is not affected - No user funds are at risk beyond the locked rent It is to note that the more tokens are added and removed, the number of orphaned accounts grows. ## Likelihood Explanation Likelihood: Low - Only the Folio Owner through a governance process can trigger this issue - Token removal is a relatively infrequent operation - The governance process provides oversight that reduces the likelihood of abuse ## Recommendation Modify the `RemoveRewardToken` struct and handler to include and close the `RewardInfo` account: - Add the -RewardInfo- account to the `RemoveRewardToken` struct: ```rust #[account(mut, seeds = [REWARD_INFO_SEEDS, folio.key().as_ref(), reward_token_to_remove.key().as_ref()], bump )] pub reward_token_reward_info: Account<'info, RewardInfo>, ``` - Modify the handler to close the account: ```rust // Close the RewardInfo account and return rent to the executor ctx.accounts.reward_token_reward_info.close(ctx.accounts.executor.to_account_info())?; ``` This fix would ensure that the `RewardInfo` account is properly closed when a reward token is removed, preventing rent leakage and maintaining data consistency.

Icarus

Biography