Submission Details
Severity:
Missing access control for LiquidationPoolManager::runLiquidation()
Summary
The function LiquidationPoolManager::runLiquidation() doesn't have access controls which means anyone can call runLiquidation() anytime.
It has to have an owner or admin or manager control to run the said function as intended and not ruin the workings of the whole protocol.
Vulnerability Details
Looking at said function runLiquidation() anybody can pass a valid _tokenId and liquidate it anytime.
function runLiquidation(uint256 _tokenId) external {...}
Impact
It will ruin the mechanism of the liquidation system which is one of the core systems of the protocol.
Tools Used
Manual Review
Recommendations
Add onlyOwner modifier to the function.
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.