The Standard

Summary

When there is a changes of TokenManager, it will create an unsync value of TokenManager between LiquidationPool and LiquidationPoolManager

Vulnerability Details

First, SmartVaultManager is an upgradable, which can initialize these variables (according to SmartVaultManager.sol)

one of it's parameter is tokenManager. TokenManager is not an upgradable contract, thus if exist any changes, the address need to be updated into the SmartVaultManager via initialize (upgrades)

now if we look at LiquidationPoolManager constructor

the tokenManager value is being used in constructor to create LiquidationPool.

meanwhile in LiquidationPool contract:

here we can see the manager is not immutable, means there is a possibility it will be updated, this also follows the SmartVaultManager where tokenManager can be changed. But inside LiquidationPool there is no function to update this tokenManager

Further more, unlike LiquidationPoolManager where in order to get the accepted token is via ITokenManager.Token[] memory tokens = ITokenManager(manager.tokenManager()).getAcceptedTokens();, in LiquidationPool it is using the static tokenManager variable ITokenManager.Token[] memory _tokens = ITokenManager(tokenManager).getAcceptedTokens();

This will resulting potential different of tokenManager instance between LiquidationPoolManager and LiquidationPool.

For example, if the newest tokenManager contract contains an updated patch or version, the LiquidationPool will still hold the old one.

I understand, the TokenManager.sol is not in scope, but the issue is not about it. The issue is on the LiquidationPool contract when there is changes of TokenManager address.

Impact

If a newer TokenManager contract contains crucial patches or updates, the LiquidationPool could continue to use the old, potentially less secure, version.

Tools Used

Manual analysis

Recommendations

Pass the smartVaultManager to LiquidationPool instance instead of passing the value of TokenManager, and use ITokenManager.Token[] memory tokens = ITokenManager(manager.tokenManager()).getAcceptedTokens(); for synced one.