search

code-423n4 / 2021-11-unlock-findings

0 stars 0 forks source link

Can set arbitrary lock templates #158

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

cmichel

Vulnerability details

The Unlock.setLockTemplate function sets the default lock tempalte for new lock creations. However, it does not verify that this lock template is a valid template that was added to _publicLockVersions via addLockTemplate.

Impact

A default template with a wrong version number can be set which is incompatible with updating locks through upgradeLock (requires version == currentVersion + 1).

Recommended Mitigation Steps

Add new lock templates using addLockTemplate first and restrict setLockTemplate to only use these templates, not arbitrary code.

julien51 commented 2 years ago

Indeed, we could improve things by making sure that setLockTemplate is called with a version number rather than the address of a lock template.