DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Short record owner can pick their favorite flagger when combining records

caventa

Summary

Short record owner can pick their favorite flagger when combining records.

Vulnerability Details

When a user combines their short records, they can choose which flagger they want for the new combined record. They do this by picking that record first.

Refer to ShortRecordFacet#combineShorts

STypes.ShortRecord storage firstShort = s.shortRecords[asset][msg.sender][ids[0]];
​
...
​
// Merge all short records into the short at position id[0]
firstShort.merge(ercDebt, ercDebtSocialized, collateral, yield, c.shortUpdatedAt);

All the short records will be merged into id[0]

Impact

Users can favor one flagger over others when joining records.

Tools Used

Manual

Recommendations

It's acceptable for short record holders to dismiss flaggers when combining their records. Still, the record owner might consider giving a minor fee to the flaggers as appreciation. This way, the importance of the removed flagger remains recognized.

Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: User experience and design improvement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.