Lines of code

https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/lib.rs#L1121

Vulnerability details

Impact

The inability to update the emergency_council in update_emergency_council_7_D_0_C_1_C_58 Function means that the contract's emergency management system will not function as intended. If an emergency occurs, the correct council may not have the authority to disable pools, which could lead to significant security or operational risks.

Proof of Concept

The update_emergency_council_7_D_0_C_1_C_58 function in the lib.rs contract of the Seawater package is intended to update the emergency council. The role of the emergency council is to disable the pools in case of an emergency. However, instead of correctly calling self.emergency_council.set(emergency_council) to update the emergency council, the function incorrectly calls self.nft_manager.set(manager). As a result, the contract fails to update the emergency_council address, which is responsible for activating and disabling emergency mode functionality. pkg/seawater/src/lib.rs:update_emergency_council_7_D_0_C_1_C_58-L-L1121

1109 @audit=>   /// Update the emergency council that can disable the pools.
                #[allow(non_snake_case)]
                pub fn update_emergency_council_7_D_0_C_1_C_58(
                    &mut self,
                    manager: Address,
                ) -> Result<(), Revert> {
                    assert_eq_or!(
                        msg::sender(),
                        self.seawater_admin.get(),
                        Error::SeawaterAdminOnly
                    );

1121 @audit=>       self.nft_manager.set(manager);

                    Ok(())
                }

Tools Used

Manual Review

Recommended Mitigation Steps

It is recommended to modify the update_emergency_council_7_D_0_C_1_C_58 function to ensure that it correctly updates the emergency council by calling self.emergency_council.set(emergency_council). This will enable the contract to update the emergency council address and ensure that the emergency functionality works as expected.

Assessed type

Error

code-423n4 / 2024-08-superposition-validation

Incorrect Role Update in `update_emergency_council_7_D_0_C_1_C_58` Function of `lib.rs` to Disable the Pools in Case of an Emergency #194