Function unpause() in PoolFactory.sol can be called by both Governor and Admin but the @dev Natspec comment incorrectly says that this is only callable by Governor.
Therefore, the Natspec comment for this function is incorrect:
@dev Triggers unpaused state. Returns functionality for certain functions. Only Governor can call this function.
lucas-manuel
commented
3 years ago
Handle
0xRajeev
Vulnerability details
Impact
Function unpause() in PoolFactory.sol can be called by both Governor and Admin but the @dev Natspec comment incorrectly says that this is only callable by Governor.
Therefore, the Natspec comment for this function is incorrect: @dev Triggers unpaused state. Returns functionality for certain functions. Only Governor can call this function.
Proof of Concept
https://github.com/maple-labs/maple-core/blob/355141befa89c7623150a83b7d56a5f5820819e9/contracts/PoolFactory.sol#L130-L136
Tools Used
Manual Analysis
Recommended Mitigation Steps
Change @dev Natspec comment to correctly indicate this function can be called by both Governor and Admin