Incomplete README.md which can mislead researchers.
Summary
In the README.md file at line 74, some functions have not been added to the Governor role but they assume that role
Vulnerability Detail
looking at setBlockHeightSubmissionsThreshold and setSecondsPerBlock function you will observe that they assume the Governor role with the onlyGovernor modifier.
But in the README.md you will not find these functions specified in the Governor role section.
Impact
The specified section in the README misinforms researchers
4b
medium
Incomplete
README.md
which can mislead researchers.Summary
In the
README.md
file at line 74, some functions have not been added to the Governor role but they assume that roleVulnerability Detail
looking at
setBlockHeightSubmissionsThreshold
andsetSecondsPerBlock
function you will observe that they assume the Governor role with theonlyGovernor
modifier. But in theREADME.md
you will not find these functions specified in the Governor role section.Impact
The specified section in the README misinforms researchers
Code Snippet
Functions with the role: https://github.com/sherlock-audit/2023-11-covalent/blob/main/cqt-staking/contracts/BlockSpecimenProofChain.sol#L312-L323
Role that needs to be updated in README.md: https://github.com/sherlock-audit/2023-11-covalent/blob/main/README.md?plain=1#L74
Tool used
Manual Review
Recommendation
The Governor role in the ProofChain Contract under the question "Q: Are there any additional protocol roles? If yes, please explain in detail: " needs to be updated with these functions:
setBlockHeightSubmissionsThreshold()
andsetSecondsPerBlock()