search

sherlock-audit / 2022-10-mover-judging

1 stars 0 forks source link

sorrynotsorry - Card Partner address lacks of sanity checks and not done in 2 steps #93

Closed sherlock-admin closed 2 years ago

sherlock-admin commented 2 years ago

sorrynotsorry

informational

Card Partner address lacks of sanity checks and not done in 2 steps

Summary

HardenedTopupProxy has setCardPartnerAddress function to set the L1 Eth address for card topup settlement. But this important change should be in two steps as;

  1. There is no sanity check carried out.
  2. Human error

    Vulnerability Detail

    A wrong card partner address set can lead the funds to be sent to a wrong EOA address including address(0), or worst - to a contract.

    Impact

    Loss of funds

    Code Snippet

    function setCardPartnerAddress(address _cardPartnerAddress) public onlyAdmin {
    cardPartnerAddress = _cardPartnerAddress;
}

    Permalink

    Tool used

Manual Review

Recommendation

Carry out the address change in two steps as in OpenZeppelin's ownable.sol