Open arjun-io opened 1 year ago
These issues are not included in the contest pool rewards
From WatchPug,
While we cannot see a way to exploit this Reentrancy to unauthenticated contracts, the fix did prevent calls to unauthentic vaults and markets.
However, the COMMIT_PRICE
action can still be used to call an unauthenticated oracleProvider
.
From WatchPug,
![]()
While we cannot see a way to exploit this Reentrancy to unauthenticated contracts, the fix did prevent calls to unauthentic vaults and markets.
However, the
COMMIT_PRICE
action can still be used to call an unauthenticatedoracleProvider
.
Since the oracle factory has multiple levels of abstraction this change can be quite complex so while we recognize this is true, since there is no clear malicious use here we're going to not add the oracle check.