search

code-423n4 / 2021-10-defiprotocol-findings

0 stars 0 forks source link

`Auction.settleAuction()` and `IAuction.settleAuction()` accept arguments with different data locations #41

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pants

Vulnerability details

The function Auction.settleAuction() claims to override IAuction.settleAuction(), but their arguments have different data locations.

Impact

Mismatching data locations in overrides have unexpected behavior.

Proof of Concept

https://github.com/ethereum/solidity/issues/10900

Tool Used

Manual code review.

Recommended Mitigation Steps

Modify the data locations of the arguments to match between Auction.settleAuction() and IAuction.settleAuction().

GalloDaSballo commented 2 years ago

I agree with the finding, however, the compiler will either refuse to compile, or simply use the data location from the actual implementation of the method (Auction).

As such, I will downgrade the finding to low severity, as it has to do with improper code / documentation more so than a functionality that can actually reduce protocol availability