code423n4 commented 3 years ago

Handle

0xRajeev

Vulnerability details

Impact

A zero or some minimum threshold check is missing for newMaxAssets parameter of _setMaxAssets() function which is used by admin to set the maximum number of assets that controls how many markets can be entered.

If accidentally set to 0 then all users cannot enter any market which will significantly affect protocol operations.

Proof of Concept

https://github.com/code-423n4/2021-04-basedloans/blob/5c8bb51a3fdc334ea0a68fd069be092123212020/code/contracts/Comptroller.sol#L954-L971

Tools Used

Manual Analysis

Recommended Mitigation Steps

Add zero/threshold check to newMaxAssets parameter.

ghoul-sol commented 3 years ago

Added to backlog, however, it's a non-critical issue.

cemozerr commented 3 years ago

Rating this as low risk as it could pose a situation where users can not enter any markets.

code-423n4 / 2021-04-basedloans-findings