Closed c4-bot-8 closed 5 months ago
GalloDaSballo marked the issue as sufficient quality report
Worth quickly checking
GalloDaSballo marked the issue as primary issue
yeah this is intended to be only one time operation without allowing to go back
should be closed
trust1995 marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PositionNFTs.sol#L64-L69
Vulnerability details
Impact
The function
blockReservePublic()
is used to lock reserve functionalities while minting PositionNFTS. However the main issue here is once it is locked or paused, you can never unlock/unpause it.Proof of Concept
As seen above, the only variable that the
blockReservePublic()
can be set is true. This makes it impossible to set to false to allow NFTID reservations.Tools Used
Manual Review
Recommended Mitigation Steps
Add a bool parameter which will allow/block reserve from public use.
Assessed type
DoS