search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

Missing DAO functionality to call changeDAO() function in Vader.sol #161

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

0xRajeev

Vulnerability details

Impact

changeDAO() is authorized to be called only from the DAO (per modifier) but DAO contract has no corresponding functionality to call changeDAO() function. As a result, DAO address cannot be changed.

Proof of Concept

https://github.com/code-423n4/2021-04-vader/blob/3041f20c920821b89d01f652867d5207d18c8703/vader-protocol/contracts/Vader.sol#L192-L196

Tools Used

Manual Analysis

Recommended Mitigation Steps

Add functionality to DAO to be able to call changeDAO() of Vader.sol.

strictly-scarce commented 3 years ago

https://github.com/code-423n4/2021-04-vader-findings/issues/46

dmvt commented 3 years ago

Unlike #140, #157, #158, & #159 without this functionality missing functionality in the DAO becomes a very serious issue. As a result, this one is very high risk were it to be overlooked.