search

code-423n4 / 2024-05-gondi-mitigation-findings

0 stars 0 forks source link

H-03 MitigationConfirmed #52

Open c4-bot-8 opened 3 months ago

c4-bot-8 commented 3 months ago

Lines of code

Vulnerability details

Issue

Function distribute() could trigger internal accounting for Pool. However, there is no access control for this function. As a result, anyone could directly call it with malicious data, leading to incorrect accounting in the Pool.

Mitigation

Only allow Liquidator contract to call the distribute() function.

function distribute(uint256 _proceeds, IMultiSourceLoan.Loan calldata _loan) external {
+    if (msg.sender != getLiquidator) {
+        revert InvalidCallerError();
+    }
c4-judge commented 3 months ago

alex-ppg marked the issue as satisfactory