Disabled SphereXEngine Proctection.

[howlbot-integration[bot]]

Lines of code

https://github.com/code-423n4/2024-08-wildcat/blob/fe746cc0fbedc4447a981a50e6ba4c95f98b9fe1/src/WildcatArchController.sol#L61

Vulnerability details

Impact

In WildcatArchController.sol file "WildcatArchController" contract constructor is passing "SphereXEngine's" engine address = 0 which will disable all SphereXEngine's protection.

Proof of Concept

1. In WildcatArchController.sol file "WildcatArchController" contract's

   constructor() SphereXConfig(msg.sender, address(0), address(0)) {

   2.The address of the SphereXEngine - this is the address to which data is sent, and which classifies the transaction (at various points of execution). If this value is address(0), the engine will be bypassed, essentially disabling its protection. From SphereXEngine's github

   Tools Used

   Manual review

   Recommended Mitigation Steps

2. Pass SphereXEngine's engine address in constructor of WildcatArchController .

Assessed type

Library

[c4-judge]

3docSec marked the issue as unsatisfactory: Insufficient proof