Closed howlbot-integration[bot] closed 3 months ago
https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L177-L207 https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L210-L242
There is inconsistency in validation between approving & disapproving the proposed price.
While disapproving a proposal, whether the same user has approved the same proposal or not is checked
if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId) revert ProposalAlreadyApprovedError(); if (usdUpdateProposal.disapprovals[msg.sender] == _usdProposalId) revert ProposalAlreadyDisapprovedError();
But when approving the proposal, no check is there for whether the same user has disapproved it or not.
if (usdUpdateProposal.approvals[msg.sender] == _usdProposalId) revert ProposalAlreadyApprovedError();
Perform the below check in approveUSDPrice
if (usdUpdateProposal.disapprovals[msg.sender] == _usdProposalId) revert ProposalAlreadyDisapprovedError();
Invalid Validation
alex-ppg marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L177-L207 https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L210-L242
Vulnerability details
Impact
There is inconsistency in validation between approving & disapproving the proposed price.
Proof of Concept
While disapproving a proposal, whether the same user has approved the same proposal or not is checked
But when approving the proposal, no check is there for whether the same user has disapproved it or not.
Recommended Mitigation Steps
Perform the below check in approveUSDPrice
Assessed type
Invalid Validation