search

code-423n4 / 2021-04-marginswap-findings

1 stars 0 forks source link

Inconsistent Use of RoleCache in RoleAware.sol #68

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

jvaqa

Vulnerability details

Impact

isStakePenalizer() function does not use the roleCache, but all of the other nearly identical role getter functions do use it.

Proof of Concept

isStakePenalizer() uses: 'return roles.getRole(STAKE_PENALIZER, contr);'

whereas all of the other getter functions resemble:

'return roleCache[contr][TOKEN_ACTIVATOR];

Recommended Mitigation Steps

Change this: return roles.getRole(STAKE_PENALIZER, contr); to this: return roleCache[contr][STAKE_PENALIZER];

zscole commented 3 years ago

Duplicate of #12