circlefin / stablecoin-evm

Source repository for smart contracts used by Circle's stablecoins on EVM-compatible blockchains
Apache License 2.0
545 stars 331 forks source link

function `setMinterManager` should verify the input #449

Open gzliudan opened 5 months ago

gzliudan commented 5 months ago

The function setMinterManager does not verify if the input parameter _newMinterManager implements MinterManagementInterface now. So the variable minterManager maybe set to the wrong value by accident.

    function setMinterManager(address _newMinterManager) public onlyOwner {
        emit MinterManagerSet(address(minterManager), _newMinterManager);
        minterManager = MinterManagementInterface(_newMinterManager);
    }

I suggest the following new codes:

    function setMinterManager(address _newMinterManager) public onlyOwner {
        require(
            !MinterManagementInterface(_newMinterManager).isMinter(address(0)),
            "invalid minter mangaer"
        );
        emit MinterManagerSet(address(minterManager), _newMinterManager);
        minterManager = MinterManagementInterface(_newMinterManager);
    }

Or check it by ERC-165.