Closed c4-bot-7 closed 5 months ago
contract WiseLending is PoolManager {
Looks wrong since WiseLending IS PoolManager
GalloDaSballo marked the issue as insufficient quality report
trust1995 marked the issue as unsatisfactory: Insufficient proof
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/FeeManager/FeeManager.sol#L394
Vulnerability details
Impact
According to the dev note
FeeManager.addPoolTokenAddress() is expected to be called during the pool creation and only by the WiseLending contract.
While, indeed the function is called during pool creation, this call is actually an external call from the PoolManager contract in line260 of PoolManager contract
However, the modifier
onlyWiseLending()
checksmsg.sender == address(WISE_LENDING)
, if false the call reverts.Since the call is from the PoolManager,
FeeManager.addPoolTokenAddress()
would always revert.Proof of Concept
addPoolTokenAddress() function expected to be called by WiseLending contract only https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/FeeManager/FeeManager.sol#L390C5-L406C6
Call to FeeManager.addPoolTokenAddress() from PoolManager contract https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/PoolManager.sol#L260-L262
onlyWiseLending() modifier checks if caller is WiseLending contract https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/FeeManager/DeclarationsFeeManager.sol#L181-L183
https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/FeeManager/DeclarationsFeeManager.sol#L213-L222C6
Tools Used
Manual
Recommended Mitigation Steps
the function should be called by the PoolManager contract rather than WiseLending.
Assessed type
Other