Submission Details
Severity:
No check if `p.loanToken` and `p.collateralToken` are contracts when updating the pool
Summary
setPool function in Lender.sol contract does not check if pool parameters p.loanToken and p.collateralToken are contracts.
Tools Used
Manual Review
Recommendations
Use OpenZeppelin isContract(address account) function to check if the input address is a contract
Example:
function setPool(Pool calldata p) public returns (bytes32 poolId) {
...
require(isContract(p.loanToken) && isContract(p.collateralToken), "Token is not a contract");
...
}
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628
USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.