search

code-423n4 / 2022-01-sherlock-findings

0 stars 0 forks source link

anyone can call forceRemoveByActiveBalance() #250

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

Tomio

Vulnerability details

Impact

A user can call forceRemoveByActiveBalance() and this function didn’t verify if the caller is equal to the protocol agent, that eventually clear the remaining balance.

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/SherlockProtocolManager.sol#L615

jack-the-pug commented 2 years ago

It's a feature, not a bug:

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/SherlockProtocolManager.sol#L612-L615