RatesAtExpiryStored can only be set to True

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2024-02-spectra/blob/main/src/tokens/PrincipalToken.sol#L413

Vulnerability details

Impact

Once ratesAtExpiryStored is set to true, it cannot be Reserved which would affect changes that need to made to the contract only when ratesAtExpiryStored is false

Proof of Concept

    function storeRatesAtExpiry() public override afterExpiry {
        if (ratesAtExpiryStored) {
            revert RatesAtExpiryAlreadyStored();
        }
>>>        ratesAtExpiryStored = true;
        // PT rate not rounded up here
        (ptRate, ibtRate) = _getCurrentPTandIBTRates(false);
        emit RatesStoredAtExpiry(ibtRate, ptRate);
    }

As noted from the code above in the storeRatesAtExpiry() function in the PrincipalToken contract, storeRatesAtExpiry is set to true but the problem is that a look at the contract shows that there is no way to reverse this, in situation where changes need to be made to the contract that requires ratesAtExpiryStored to be false, it would cause a problem for the protocol.

Tools Used

Manual Review

Recommended Mitigation Steps

Protocol should add implementation to ensure ratesAtExpiryStored is not completely permanently set to true, it should have a function that is handled by Admin to set it back to false in situations adjustment need to be made in the code base

Assessed type

Access Control

[c4-pre-sort]

gzeon-c4 marked the issue as insufficient quality report

[gzeon-c4]

invalid

[c4-judge]

JustDravee marked the issue as unsatisfactory: Invalid