LiquidationPool.distributeAssets() Should Be Called Only by Manager
Summary
distributeAssets is being called using:
_assets, _collateralRate, and _hundredPCare crucial parameters that users should not be able to customize in the call.
Vulnerability Details
The call has access to overwrite the storages of all holders, such as positions and rewards for each token. Additionally, the function has access to burning EUROs, and the ability to edit parameters like _collateralRate, _assets (and their decimals to achieve desired results in rewards), and _hundredPC.
Impact
The impact can be as severe as withdrawing our position and burning all remaining EUROs in the contract, causing losses for all holders.
Tools Used
Manual Review
Recommendations
Restrict the call to only allow the manager to execute it. Revert the call for all msg.sender != manager.
Lead Judging Commences
distributeAssets-issue
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.