sherlock-audit / 2024-08-woofi-solana-deployment-judging

0 stars 0 forks source link

Cuddly Gauze Mustang - Any user will initialize WooFi program before the protocol #30

Open sherlock-admin2 opened 15 hours ago

sherlock-admin2 commented 15 hours ago

Cuddly Gauze Mustang

Medium

Any user will initialize WooFi program before the protocol

Summary

A lack of access control will lead any user to front-run create_config initialization.

Root Cause

In create_config.rs#L11-L19, the WooConfig can be initialized only once.
In create_config.rs#L24, there is no access control.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

The protocol can't initialize the WooConfig structure.

PoC

No response

Mitigation

Implement an access control mechanism on this instruction.

toprince commented 4 hours ago

Same with https://github.com/sherlock-audit/2024-08-woofi-solana-deployment-judging/issues/14