Governance of Market.sol can call following function at anytime.
This is not ideal since they can call this function for their own benefits.
For example they can change liquidationFactorBps to gain more liquidationFee.
They can change collateralFactorBps to make user borrow less or to liquidate them.
Lines of code
https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L149 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L161 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L172 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L183 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L194
Vulnerability details
Impact
Governance of
Market.sol
can call following function at anytime. This is not ideal since they can call this function for their own benefits. For example they can changeliquidationFactorBps
to gain moreliquidationFee
. They can changecollateralFactorBps
to make user borrow less or to liquidate them.setCollateralFactorBps
setLiquidationFactorBps
setReplenismentIncentiveBps
setLiquidationIncentiveBps
setLiquidationFeeBps
Proof of Concept
No implementation are done to avoid malicious governance to change these important state variables at any time they want.
Tools Used
Manual Analysis
Recommended Mitigation Steps
Add timelock implementation so that user can know the change before it gets executed. Reference: https://blog.chain.link/timelock-smart-contracts/