hats-finance / Inverter-Network-0xe47e52c4fea05e555920f1dcdcc6fb8eca103eeb

Fork of the Inverter Smart Contracts Repository
GNU Lesser General Public License v3.0
0 stars 3 forks source link

`OptimisticOracleIntegrator` doesn't add `IOptimisticOracleIntegrator`/`OptimisticOracleV3CallbackRecipientInterface` interfaceId as supported interfaces #74

Open hats-bug-reporter[bot] opened 2 weeks ago

hats-bug-reporter[bot] commented 2 weeks ago

Github username: @NicolaMirchev Twitter username: EgisSec Submission hash (on-chain): 0xcdd54cbbb6c732d5f07b6fca3d63356fe7a2d886ccc0daeb131b26507a126850 Severity: low

Description: Description\ Protocol implements ERC165, which is used to check if give contract support given interface id. Example in it's implementation in Module_v1, which is parent of OptimisticOracleIntegrator:

    function supportsInterface(bytes4 interfaceId)
        public
        view
        virtual
        override(ERC165)
        returns (bool)
    {
        return interfaceId == type(IModule_v1).interfaceId
            || super.supportsInterface(interfaceId);
    }

This following could result in even major impact depending on external integrations of this protocol. But having in mind that IOptimisticOracleIntegrator is an important interface, which shows that contract has mandatory functions for being a msg.sender when an assertation in OO_V3 is made. Those are described in OptimisticOracleV3CallbackRecipientInterface.

Attack Scenario\ Read above

Attachments

  1. Proof of Concept (PoC) File As the issue is simple, PoC is not provided.

  2. Revised Code File (Optional) Override supportsInterface in OptimisticOracleIntegrator and add OptimisticOracleV3CallbackRecipientInterface + IOptimisticOracleIntegrator interface ids

0xmahdirostami commented 1 week ago

thanks, valid as low