Submission Details
Severity:
Missing permissions check on LiquidationPool.distributeAssets function
Summary
Function distributeAssets in contract LiquidationPool has no permissions checks, but must be called only by LiquidationPoolManager contract.
Vulnerability Details
Function distributeAssets recalculates rewards based on the passed in parameter _assets . Since the onlyManager modifier is missed, anyone can call the function and pass any assets with any amounts. Based on the passed parameter values the function recalculates rewards, so the issue has high severity.
Impact
Anyone can call the function and recalculate rewards.
Tools Used
Manual review
Recommendations
Add onlyManager modifier to the function.
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Assigned finding tags:
distributeAssets-issue
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.