search

code-423n4 / 2021-12-vader-findings

0 stars 0 forks source link

_addUSDVPair can also update #185

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

function _addUSDVPair does not check if the foreignAsset does not exist yet, thus it is possible to override it.

Recommended Mitigation Steps

Make sure this is the intended behavior or else add validations, e.g.

  require(pairData.updatePeriod == 0, "...");