code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

User created baskets are owned by defaultController #251

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0x0x0x

Vulnerability details

User created baskets are owned by defaultController and help from the defaultController is needed to use any functionality or setup the basket. In test simply one account is used, but when a user wants to create a basket, they can’t control it properly.

Mitigation steps

Add tests with a user and defaultController and redesign the protocol accordingly.

0xleastwood commented 2 years ago

This sounds like its intended. The defaultController account handles any administrative functionality of the basket contracts. The contract owner isn't an EOA as people have stated it is.