code-423n4 / 2021-12-vader-findings

0 stars 0 forks source link

setGasThrottle function should be moved to BasePoolV2 #181

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

hyh

Vulnerability details

Impact

BasePoolV2 has gas validation modifiers used in its functions, while VaderPoolV2 doesn't yet. As setting management is implemented in VaderPoolV2, but not in BasePoolV2, other BasePoolV2 descendants will have to reimplement this function for no reason as there are no specifics there and, as general purpose functionality, it should be implemented in BasePoolV2.

Proof of Concept

All gas validation is used in base pool functions only: https://github.com/code-423n4/2021-12-vader/search?q=validateGas

However, gasThrottle setting management is implemented in VaderPoolV2, despite being of general purpose: https://github.com/code-423n4/2021-12-vader/blob/main/contracts/dex-v2/pool/VaderPoolV2.sol#L479

Recommended Mitigation Steps

Move setGasThrottle implementation from VaderPoolV2 to BasePoolV2.