Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Missing access control checks in the compound function which may lead to unauthorized users triggering compound operations

0xVinylDavyl

Summary

The GMXCompound.sol contract lacks access control in the compound function. Without proper access control, anyone can call this function, which may lead to unauthorized users triggering compound operations.

Vulnerability Details

In the GMXCompound.sol contract, the compound function lacks access control modifiers, allowing unrestricted access to this function. Here's the relevant code block with the vulnerability:

function compound(
GMXTypes.Store storage self,
GMXTypes.CompoundParams memory cp
) external {
// Transfer any tokenA/B from trove to vault
if (self.tokenA.balanceOf(address(self.trove)) > 0) {
self.tokenA.safeTransferFrom(
address(self.trove),
address(this),
self.tokenA.balanceOf(address(self.trove))
);
}
if (self.tokenB.balanceOf(address(self.trove)) > 0) {
self.tokenB.safeTransferFrom(
address(self.trove),
address(this),
self.tokenB.balanceOf(address(self.trove))
);
}
​
​
uint256 _tokenInAmt = IERC20(cp.tokenIn).balanceOf(address(this));
​
​
// Only compound if tokenIn amount is more than 0
if (_tokenInAmt > 0) {
self.refundee = payable(msg.sender);
​
​
self.compoundCache.compoundParams = cp;
​
​
ISwap.SwapParams memory _sp;
​
​
_sp.tokenIn = cp.tokenIn;
_sp.tokenOut = cp.tokenOut;
_sp.amountIn = _tokenInAmt;
_sp.amountOut = 0; // amount out minimum calculated in Swap
_sp.slippage = self.minSlippage;
_sp.deadline = cp.deadline;
​
​
GMXManager.swapExactTokensForTokens(self, _sp);

Impact

An unauthorized users can invoke the compound function without any restrictions. This may lead to unauthorized compound operations and potentially cause unexpected interactions or disruptions in the system.

Unauthorized users can freely invoke the compound function, which is intended for controlled and authorized access. The consequences of this lack of access control include:

  • Unauthorized users can initiate compound operations, potentially interfering with the intended operation of the contract.

  • Financial losses or exploitation can occur due to unauthorized compound transactions.

  • The overall security and integrity of the smart contract and the associated system are compromised.

Tools Used

Manual

Recommendations

Mitigating this vulnerability, proper access control should be implemented by using modifiers like onlyController to ensure that only authorized users can call the compound function.
By adding the onlyController modifier, only authorized controllers can call the compound function, enhancing the security of the smart contract.

// Define a modifier for access control
modifier onlyController() {
// Check if the caller is an authorized controller
require(msg.sender == self.controller, "Unauthorized access");
_;
}
​
function compound(
GMXTypes.Store storage self,
GMXTypes.CompoundParams memory cp
) external onlyController {
// Only authorized controllers can call this function
// ...
}
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.