search

code-423n4 / 2022-01-sherlock-findings

0 stars 0 forks source link

SherlockClaimManager: Clarify why sherlockCore is used as proposer in UMA.requestAndProposePriceFor() #220

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

GreyArt

Vulnerability details

Impact

UMA.requestAndProposePriceFor(
  UMA_IDENTIFIER, // Sherlock ID so UMA knows the request came from Sherlock
  claim.timestamp, // Timestamp to identify the request
  claim.ancillaryData, // Ancillary data such as the coverage agreement
  TOKEN, // USDC
  0, // Reward is 0, Sherlock handles rewards on its own
  BOND, // Cost of making a request to the UMA OO (as decided by Sherlock)
  LIVENESS, // Proposal liveness
  address(sherlockCore), // Sherlock core address
  0 // price
);

The provided comment doesn’t help one understand why sherlockCore is passed in as a parameter until one understands the process.

To escalate claims, the protocol is required to “stake” a reasonable amount. If proven correct, they would be refunded to this “stake” and be entitled to the insured payout. Otherwise, it gets sent to request.proposer, which is the sherlockCore address.

Recommended Mitigation Steps

The comment can be modified to help users understand why sherlockCore is used.

UMA.requestAndProposePriceFor(
  ...
  address(sherlockCore), // If escalated claim fails, bond amount gets sent to sherlockCore
  0 // price
);