Submission Details
Severity:
Attacker can manipulate the asset distribution
Summary
Attacker can manipulate the rewards that are to be distributed as distributeAssets() function is external and callable by anyone.
Vulnerability Details
As the distributeAssets() function can be called by anyone, attacker might define there own _collateralRate. Stakers gets the assets according to the collateral rate. This creates the problem.
Impact
As the collateral rate directly affects the asset to be receive by the stakers. Stakers might not get the assets they should get.
Tools Used
Manual Review
Recommendations
Use the Role-Based Access Control (RBAC) access control like in distributeFees function.
+ function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable onlymanager {
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Assigned finding tags:
distributeAssets-issue
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.