Submission Details
Severity:
Contract creation utilizing wrong address
Summary
The protocol sets the liquidation pool manager in this SmartVaultManagerV5.sol
function setProtocolAddress(address _protocol) external onlyOwner() {
protocol = _protocol;
}
The multisig treasury is set in LiquidationPoolManager::constructor
constructor(address _TST, address _EUROs, address _smartVaultManager, address _eurUsd, address payable _protocol, uint32 _poolFeePercentage) {
pool = address(new LiquidationPool(_TST, _EUROs, _eurUsd, ISmartVaultManager(_smartVaultManager).tokenManager()));
TST = _TST;
EUROs = _EUROs;
smartVaultManager = _smartVaultManager;
protocol = _protocol; // @audit multisig
poolFeePercentage = _poolFeePercentage;
}
Impact
Deployer has a high chance of deploying to the wrong address with funds redirected to it.
Tools Used
Manual Review
Recommendations
Change the naming convention used in the LiquidationPoolManager from protocol to multisig while in the SmartVaultManagerV5 to LiquidationManager
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
informational/invalid
thedoctor
almost 2 years ago
hrishibhat
over 1 year ago
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.