code-423n4 / 2021-04-maple-findings

0 stars 0 forks source link

Missing non-zero check #87

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

@cmichelio

Vulnerability details

Vulnerability Details

The MapleGlobals.setPriceOracle should check that the oracle address is not zero.

Impact

A wrong call to this function might set the oracle address to the zero address and break core oracle functionality.

Recommended Mitigation Steps

Add a require(oracle != 0) statement.

lucas-manuel commented 3 years ago

Will address

lucas-manuel commented 3 years ago

We actually are not going to address this, we do not think this is a bug. The governor will manually verify non-zero addresses.

Arachnid commented 3 years ago

I think this warrants Likelihood=Low,Impact=Medium => Severity=Low. Unlike deployment misconfigurations, this mistake, while unlikely, would impact the running system, and it's easily defended against.