sherlock-audit / 2023-03-Y2K-judging

7 stars 1 forks source link

0xnirlin - Treasury can never be changed on vaults even after calling changeTreasury() #500

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

0xnirlin

medium

Treasury can never be changed on vaults even after calling changeTreasury()

Summary

changeTreasury() in VaultFactory contract is meant to change the treasury on both the vaults of certain epoch ids but it doesn't do so.

Vulnerability Detail

Look at the following code:

    function changeTreasury(
        uint256 _marketId,
        address _treasury
    ) public onlyTimeLocker {
        if (_treasury == address(0)) revert AddressZero();

        address[2] memory vaults = marketIdToVaults[_marketId];

        if (vaults[0] == address(0) || vaults[1] == address(0)) {
            revert MarketDoesNotExist(_marketId);
        }
        IVaultV2(vaults[0]).whiteListAddress(_treasury);
        IVaultV2(vaults[1]).whiteListAddress(_treasury);
        IVaultV2(vaults[0]).setTreasury(treasury);
        IVaultV2(vaults[1]).setTreasury(treasury);

        emit AddressWhitelisted(_treasury, _marketId);
    }

setTreasury() when called on vaults wrong argument is passed into them, instead of passing _treasury, treasury is passed. So it never allows to change the treasury.

Impact

It can lead to wrong distribution of funds when fee is transferred to treasury, funds maybe sent to wrong address or deprecated treasury

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/VaultFactoryV2.sol#L228

Tool used

Manual Review

Recommendation

  1. Add following code before calling setTreasury(treasury) on vaults
    setTreasury(_treasury)

    this will set right treasury on factory.

  2. Or pass the right argument _treasury when calling setTreasury on vaults

Duplicate of #435