lidofinance / core

Lido DAO smart contracts
https://lido.fi
GNU General Public License v3.0
382 stars 193 forks source link

LegacyOracle.finalizeUpgrade_V4 can be called multiple times #707

Closed TheDZhon closed 1 year ago

TheDZhon commented 1 year ago

Due to the changed version slot position (from CONTRACT_VERSION_POSITION_DEPRECATED to CONTRACT_VERSION_POSITION), it wasn't checked in the Lido V2 branch (#482) that LegacyOracle.finalizeUpgrade_V4 must not be called more than once.

While the protocol itself doesn't rely on this contract anymore, it could have broken external integrations by changing the time specs stored in the contract.

The issue is resolved in #705

Regression was introduced in https://github.com/lidofinance/lido-dao/commit/1e643f08d77c410668730a0ab9935954103becc4

TheDZhon commented 1 year ago

Delivered in v2.0.0-rc.0-hotfix