Duplicate LP token could lead to incorrect reward distribution

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/convex-platform/contracts/contracts/ConvexMasterChef.sol#L96

Vulnerability details

Impact

It was observed that add function is not checking for duplicate lpToken which allows 2 or more pools to have exact same lpToken. This can cause issue with reward distribution

In case of duplicate lpToken, lpSupply will become incorrect (ConvexMasterChef.sol#L160), hence rewards will be calculated incorrectly

Proof of Concept

1. Owner call add function and uses lpToken as A
2. Owner again call add function and mistakenly provides lpToken as A
3. Now 2 pools will be created with lpToken as A
4. This becomes a problem while reward calculation or updatePool function which uses pool.lpToken.balanceOf(address(this)). Since both pool have same lpToken so lpSupply will be calculated as same which is wrong. Since lpSupply defines the rewardRate so this directly impact reward calculation

Recommended Mitigation Steps

Add a global variable keeping track of all lpToken added for pool. In case of duplicate lpToken add function should fail.

[0xMaharishi]

Given the result of this would be a net negative to everyone (due to overall increased lp token supply) there doesn't seem to be any incentive for anyone to do this. Considering that the owner is a distributed 4 of 7 multisig, i think it is an acceptable scenario

[dmvt]

I'm going to let this one stand. Multisigs make mistakes and it would be trivial to prevent this one.