search

code-423n4 / 2021-04-basedloans-findings

0 stars 1 forks source link

Privileged roles #35

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

@cmichelio

Vulnerability details

Vulnerability Details

Admins can change the comp=blo address using _setCompAddress and stop pending payouts using _dropCompMarket.

Impact

The allotted rewards of the users may not be paid out anymore due to admins changing the reward token (comp) address. Privileged admin roles make the protocol less predictable for users leading to hesitance and lost opportunity costs when

Recommended Mitigation Steps

Only set the comp/blo address if it has not been set already. Distribute the rewards up to now before cancelling rewards using _dropCompMarket.

ghoul-sol commented 3 years ago

This is technically correct, however, having a context that admin role is only temporary and will be moved to governance in the near future, I don't consider this as an issue. Especially that Comptroller is using a proxy pattern so admin can always change the implementation at will. I consider this a non-critical issue.

cemozerr commented 3 years ago

I'm rating this a non-critical issue, as the Comptroller using a proxy pattern would make this change redundant.