DittoETH

Summary

Although the function checks shorter == msg.sender, the user can still buy time for liquidation. Because mas.sender may be another account of the shorter

Vulnerability Details

https://github.com/Cyfrin/2023-09-ditto/blob/main/contracts/facets/MarginCallPrimaryFacet.sol#L49

Impact

the user can still buy time for liquidation.

Tools Used

manual

Recommendations

I think this is a design issue, maybe a whitelist of liquidators can be designed to only allow specific users to liquidate