search

sherlock-audit / 2023-11-olympus-judging

9 stars 7 forks source link

bareli - Interface Assumptions #187

Closed sherlock-admin closed 6 months ago

sherlock-admin commented 6 months ago

bareli

medium

Interface Assumptions

Summary

Interface Assumptions: The contract assumes that any address passed to getPriceFromUnderlying as asset_ conforms to the ERC4626 standard. If an incorrect address is passed, the behavior is unpredictable.

Vulnerability Detail

ERC4626 asset = ERC4626(asset_);

Impact

Code Snippet

https://github.com/sherlock-audit/2023-11-olympus/blob/main/bophades/src/modules/PRICE/submodules/feeds/ERC4626Price.sol#L97

Tool used

Manual Review

Recommendation

we should verify the address whether it is compatible with ERC4626

nevillehuang commented 6 months ago

Invalid, it is presumed that functions will be integrated appropriately with correct inputs, there is no need for additional complexity, given also submodules are not called directly by user as mentioned in #96.