c4-bot-8 commented 5 months ago

Lines of code

https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PositionNFTs.sol#L64-L69

Vulnerability details

Impact

The function blockReservePublic() is used to lock reserve functionalities while minting PositionNFTS. However the main issue here is once it is locked or paused, you can never unlock/unpause it.

Proof of Concept

    function blockReservePublic()
        external
        onlyMaster
    {
        reservePublicBlocked = true;
    }

As seen above, the only variable that the blockReservePublic() can be set is true. This makes it impossible to set to false to allow NFTID reservations.


    modifier onlyReserveRole() {
        if (reservePublicBlocked == true) {
            if (reserveRole[msg.sender] == false) {
                revert NotPermitted();
            }
        }
        _;
    }

     function reservePositionForUser(
        address _user
    )
        onlyReserveRole
        external
        returns (uint256)
    {
        return _reservePositionForUser(
            _user
        );
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Add a bool parameter which will allow/block reserve from public use.

Assessed type

DoS

c4-pre-sort commented 5 months ago

GalloDaSballo marked the issue as sufficient quality report

GalloDaSballo commented 5 months ago

Worth quickly checking

c4-pre-sort commented 5 months ago

GalloDaSballo marked the issue as primary issue

vm06007 commented 5 months ago

yeah this is intended to be only one time operation without allowing to go back

vm06007 commented 5 months ago

should be closed

c4-judge commented 5 months ago

trust1995 marked the issue as unsatisfactory: Invalid

code-423n4 / 2024-02-wise-lending-findings

``blockReservePublic()`` cannot be reversed #213