hats-finance / Blast-Futures-Exchange-0x97895c329b950755566ddcdad3395caaea395074

0 stars 0 forks source link

Trader Role has no functionality implemented in BfxVault.sol #29

Open hats-bug-reporter[bot] opened 7 months ago

hats-bug-reporter[bot] commented 7 months ago

Github username: @0xnirlin Twitter username: 0xnirlin Submission hash (on-chain): 0x5e78b1a73a6b8d81bb079cf452d9f9d3eeefa53260df9bb2aa5c3b10a490d29a Severity: low

Description: Description\ There are three roles defined in the BfxVault.sol

uint256 public constant ADMIN_ROLE = 0;
uint256 public constant TRADER_ROLE = 1;
uint256 public constant TREASURER_ROLE = 2;

The roles have been further documented in the codebase

* @notice give the user the ADMIN_ROLE - which gives 
* the ability to add and remove roles for other users
* 
* @notice does the user have the TRADER_ROLE - which gives 
* the ability to trade on the bfx exchange with the vault's funds
* 
* @notice does the user have the TREASURER_ROLE - which gives 
* the ability to deposit the vault's funds into the bfx exchange

These are mentioned on all add, remove, is functions for the roles.

The Admin can use the addAdmin, removeAdmin(), addTrader, removeTrader, addTreasurer, removeTreasurer and other functions. The Treasurer can use the makeDeposit function.

The trader has no functions implemented in BfxVault.sol

Recommendations

alex-sumner commented 7 months ago

This is not a bug. The contract simply stores whether a particular wallet is onboarded as a trader to the vault. This information can be queried by off-chain code.