search

sherlock-audit / 2023-12-ubiquity-judging

2 stars 2 forks source link

bareli - new admin role can be same as old admin #199

Closed sherlock-admin closed 6 months ago

sherlock-admin commented 6 months ago

bareli

medium

new admin role can be same as old admin

Summary

there is no check whether old admin and new admin are equal or not.

Vulnerability Detail

function setRoleAdmin(bytes32 role, bytes32 adminRole) internal { bytes32 previousAdminRole = getRoleAdmin(role); accessControlStorage().roles[role].adminRole = adminRole; emit RoleAdminChanged(role, previousAdminRole, adminRole); }

Impact

it will cause too much gas use.

Code Snippet

https://github.com/sherlock-audit/2023-12-ubiquity/blob/main/ubiquity-dollar/packages/contracts/src/dollar/libraries/LibAccessControl.sol#L140

Tool used

Manual Review

Recommendation

use a require statement so that it is not equal.

sherlock-admin2 commented 6 months ago

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

Input validation

sherlock-admin2 commented 6 months ago

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

Input validation

nevillehuang commented 6 months ago

Invalid, this is purely a sanity check and would constitute admin input erorr not valid based on sherlock rules, see point 5. Additionally gas optimization findings are not valid based on sherlock rules.