add rate limit to calling manually fix accounting

sparrowDom commented 2 months ago

github-actions[bot] commented 2 months ago

	Warnings
:warning:	:eyes: This PR needs at least 2 reviewers

Generated by :no_entry_sign: dangerJS against d60fb5f9df579504e4f4fed43193d5a1633a3a29

sparrowDom commented 2 months ago

The workaround to continually trigger this would be:

create a contract and send 23 ETH to it
call selfDestruct on the contract and set the recipient address to native staking contract
the payable receive on native staking contract is not triggered
attacker calls doAccounting, fuse is blown
manuallyFixAccounting is called (given the strategist is compromised). Contract balance can be inflated by 332ETH

Above steps can be repeated continually if there is no rate limit on manuallyFixAccounting function and strategist account has been compromised.

OriginProtocol / origin-dollar