search

code-423n4 / 2023-08-reserve-mitigation-findings

0 stars 0 forks source link

M-02 MitigationConfirmed #6

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Lines of code

Vulnerability details

This issue is mitigated.

Explanation of found problem

When RebalancingManager decides to sell some assets, then Broker.is called, which will deploy new trade contract, which can be of 2 types Gnosis and Dutch auction. But broker will be able to deploy it only if is not disabled.

Broker can be disabled only in 1 case, when Gnosis auction reports violation as it found that received price from auction was not fair. As result of this, broker is disabled and as result BackingManager can't create new trade till the time, when broker will be enabled again. This can affect system as BackingManager will not be able to do , which will block ability to call Rtoken.redeemTo and StRSR.withdraw.

How it was fixed

Warden proposed to stop only Gnosis auction in case of violation and allow to deploy Dutch auctions. Reserve team has added ability for Dutch auctions to report violation as well. So now, in case if any Gnosis auction reported violation, then it's not allowed to create new Gnosis auction and in case if Dutch auction reported violation, then it's not allowed to create such auction with same sell or buy tokens in new auction. As result violation of one type of auction is not blocking other type of auction.

c4-judge commented 1 year ago

0xean marked the issue as nullified