Closed howlbot-integration[bot] closed 3 months ago
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L177
disapproveUSDPrice() check if pricefeed has approved or disapproved the price earlier
disapproveUSDPrice()
if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId) revert ProposalAlreadyApprovedError(); if (usdUpdateProposal.disapprovals[msg.sender] == _usdProposalId) revert ProposalAlreadyDisapprovedError();
But approveUSDPrice() only checks for approved
approveUSDPrice()
if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId) revert ProposalAlreadyApprovedError();
PriceFeed can first disapprove the price and the approve the price
VS code
Add similar check in approveUSDPrice() as disapproveUSDPrice()
Error
alex-ppg marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L177
Vulnerability details
Impact
disapproveUSDPrice()
check if pricefeed has approved or disapproved the price earlierBut
approveUSDPrice()
only checks for approvedPriceFeed can first disapprove the price and the approve the price
Proof of Concept
PriceFeed can first disapprove the price and the approve the price
Tools Used
VS code
Recommended Mitigation Steps
Add similar check in approveUSDPrice() as disapproveUSDPrice()
Assessed type
Error