search

clober-dex / coupon-finance

Coupon Finance Solidity Contracts
Other
1 stars 0 forks source link

All loanable assets can be stolen if the owner key is compromised #125

Closed detectivekim closed 11 months ago

detectivekim commented 12 months ago

Description

The privileged setLoanConfiguration() function in the LoanPositionManager can introduce new (collateral,debt) combinations without restrictions. A malicious admin could abuse it to allow borrowing against worthless tokens and drain the AssetPool.