The Standard

Summary

Missing proper access control in the LiquidationPool.distributeAssets function.

Vulnerability Details

It appears that the LiquidationPool.distributeAssets function is intended to be exclusively callable by the LiquidationPoolManager as part of the liquidation process initiated by LiquidationPoolManager.runLiquidation. However, currently, the LiquidationPool.distributeAssets function lacks access control. This oversight allows any user to call it with arbitrary parameters. These parameters include:

1. _assets array, which specifies the tokens and amounts to be distributed along with the price feed for price determination.

2. _collateralRate, utilized in calculating the costInEuros.

3. _hundredPC, a factor in the costInEuros calculation, which must be a constant (1e5)

Impact

The LiquidationPool.distributeAssets function requires token approval by the LiquidationPoolManager before transferring tokens from it. Because of this, no immediate vulnerabilities compromising the protocol are currently evident. However, future upgrades may introduce significant issues if this function remains unregulated.

Tools Used

Manual Review

Recommendations

To mitigate this issue, it is recommended to implement the onlyManager modifier in the distributeAssets function.