search

code-423n4 / 2022-05-rubicon-findings

5 stars 2 forks source link

Upgraded Q -> M from 416 [1656127851254] #466

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Judge has assessed an item in Issue #416 as Medium risk. The relevant finding follows:

HickupHH3 commented 2 years ago

RubiconMarket.sol#L1231 This function allows an attacker with a compromised key to set an arbitrarily high fee. The fee will steal an arbitrary amount from buyers (with an infinite allowance) or up to the maximum allowance set for this contract. This is in some cases mitigated by the use of the router, which allows to set a minimum amount to control slippage, but any contract or user that interacts directly with RUbiconMarket remains vulnerable.

Consider bounding feeBPS to a sensible maximum value, or introducing a timelock to allow enough time for detection and reaction in case of wrongdoing.

Dup of #21