Open code423n4 opened 2 years ago
Most of these are false-positives or out of scope, but accepting since there are a few on the list that are worthwhile to update.
Because the sponsor confirms and because even in the latest Quantstamp audit I saw the validation was deemed as low, will agree with finding and severity
Update: after analysis these three functions were deemed true-positives:
Collateral.depositTo
Collateral.withdrawTo
UOwnable.transferOwnership
UOwnable.transferOwnership
in particular was already resolved via https://github.com/code-423n4/2021-12-perennial-findings/issues/12, so the resolution only includes updates for Collateral.depositTo
and Collateral.withdrawTo
.
Handle
robee
Vulnerability details
Not verified address arguments of external/public functions is a low risk issue. It's less severe for onlyOwner methods but for any other method it's crucial since the default address is 0.