search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Setting wrong publisher cannot be undone #222

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

cmichel

Vulnerability details

The Basket.changePublisher function is used for both setting a new pending publisher as well as accepting the publisher transfer from the pending publisher.

Impact

Once a pending publisher has been set, no other publisher can be set and if the pending publisher does not accept it, the contract is locked out of setting any other publishers. Setting a wrong publisher can naturally occur.

Recommended Mitigation Steps

Add an option to set a new pending publisher even if there already is a pending publisher.

GalloDaSballo commented 2 years ago

In line with zero address check validation, given the fact that:

the lack of 2 step to claim an address can be viewed as a feature that is missing / should be added

Will set all similar issues to a low severity