search

hats-finance / Inverter-Network-0xe47e52c4fea05e555920f1dcdcc6fb8eca103eeb

Fork of the Inverter Smart Contracts Repository
GNU Lesser General Public License v3.0
0 stars 3 forks source link

`LM_PC_Bounties_v1.updateClaimDetails` lacks of access control #121

Open hats-bug-reporter[bot] opened 3 months ago

hats-bug-reporter[bot] commented 3 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x749c8109e462847ce6acdb7ffca9665e3d736718d24a3205f92f9590c48f648f Severity: medium

Description: Description\ Like LM_PC_Bounties_v1.updateClaimContributors and LM_PC_Bounties_v1.addClaim, LM_PC_Bounties_v1.updateClaimDetails should use onlyModuleRole(CLAIMANT_ROLE) modifier, but it doesnt

Attack Scenario\ _claimRegistry[claimId].details can be updated by anyone

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

PlamenTSV commented 3 months ago

Line 398: onlyModuleRole(CLAIMANT_ROLE)