code-423n4 / 2022-05-backd-findings

0 stars 0 forks source link

`RewardHandler.sol`and `FeeBurner.sol` will fail due to inexistent `AddressProvider.sol` getter functions #120

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L126

Vulnerability details

Impact

FeeBurner.burnToTarget() and RewardHandler.burnFees() will fail every time because _addressProvider.getSwapperRouter(), addressProvider.getBKDLocker() and addressProvider.getFeeBurner() are not implemented in AddressProvider.sol.

Proof of Concept

getSwapperRouter(), getBKDLocker() and getFeeBurner() not present in AddressProvider.sol.

Tools Used

Manual Review

Recommended Mitigation Steps

Implement getSwapperRouter(), getBKDLocker() and getFeeBurner() in AddressProvider.sol

chase-manning commented 2 years ago

AddressProviderHelpers