search

code-423n4 / 2022-01-sherlock-findings

0 stars 0 forks source link

`forceRemoveByActiveBalance()` is callable by anyone and is front-runnable #192

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

Dravee

Vulnerability details

Impact

This function removes a protocol with insufficient active balance and send its remaining balance to msg.sender. However, this function is callable by anyone, for any protocol. activeBalances being internal doesn't mind it cannot be read and that its information is secret. Therefore, this can be monitored and front-run.

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/SherlockProtocolManager.sol#L615-L636

Tools Used

VS Code

Recommended Mitigation Steps

Add some access control

jack-the-pug commented 2 years ago

The desired behavior, not a bug.