The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

visibility and access of `distributeAssets` is external and open, so any can provide arbitrary values for `collateralRate` and `HUNDREDPC` to disturb The Staking position of staker.

0xaman

Summary

The distributeAssets function can be call by any one so one can only provide minimum amount of ETH like 1 WEI to manipulate position of stakers in a wrong way.

Vulnerability Details

The attacker can observe the Position of stakers and chainLink oracle, whenever it seems best for his attack he can call distributeAssets function and achieve his desired results.

​
function distributeAssets(
ILiquidationPoolManager.Asset[] memory _assets,
uint256 _collateralRate,
uint256 _hundredPC
) external payable {
...

impact

The Assets in LiquidationPool are at risk to arbitrary collateral rate and hundred pc.

Tools Used

Manual Review

Recommendation

It is recommended either change the Visibility of distributeAssets function or add onlyManager modifier on this function as the function has only called inside SmartVaultManager contract.

function distributeAssets(
ILiquidationPoolManager.Asset[] memory _assets,
uint256 _collateralRate,
uint256 _hundredPC
- ) external payable {
+ ) external payable onlyManager {
...
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

distributeAssets-issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.