search

sherlock-audit / 2024-03-zap-protocol-judging

3 stars 1 forks source link

HonorLt - Unprotected destroy of IDO #130

Closed sherlock-admin4 closed 7 months ago

sherlock-admin4 commented 7 months ago

HonorLt

high

Unprotected destroy of IDO

Summary

An unprotected function destroyInstance allows anyone to destroy the scheduled sale.

Vulnerability Detail

destroyInstance function lacks access control:

    function destroyInstance(
        address _instance
    ) external onlyExist(_instance) onlyIncoming(_instance) {
        _removeFromSales(_instance);
        ITokenSale(_instance).destroy();
    }

Anyone can invoke this function to destroy the IDO before it starts.

Impact

The functionality is broken, it is practically impossible to set up a sale that starts in the future because anyone can cancel it.

Code Snippet

https://github.com/sherlock-audit/2024-03-zap-protocol/blob/main/zap-contracts-labs/contracts/Admin.sol#L140

Tool used

Manual Review

Recommendation

Add onlyRole(OPERATOR) access control modifier.

Duplicate of #118