Closed 0xdcota closed 1 year ago
Notes regarding this vulnerability.
Challenges:
setActiveProvider
to specifically test features of a newly implemented provider.setActiveProvider
.Assumptions:
rebalancer role
to arbitrary externally owned accounts (EOA).Facts:
setActiveProvider
in our testing set-ups. With the notes from my previous post I suggest the safest, simplest solution is to change that function setActiveProvider()
can only be called by the timelock.
Why this is good:
@brozorec @pedrovalido please share your thoughts on this.
What to do with L82 of RebalancerManager?
Where: https://github.com/Fujicracy/fuji-v2/blob/ab02d2308797577973ac358af8c7aadf973bcec7/packages/protocol/src/abstracts/BaseVault.sol#L487
Description: The BaseVault has the setActiveProvider functions, callable by rebalancer, that allows to change the current provider. The function is called during rebalancing. It is crucial to call this function within one transaction to make the rebalancing process an atomic process. Otherwise, the vault might be used by users after the provider is changed and before the funds are moved, which would result in transactions being reverted (e.g. borrowing from a new provider before it gets collateral).
Recommendation: Make the function internal and call it during the rebalancing process.