Submission Details
Severity:
LiquidationPool.distributeAssets function lacks permission control
Summary
LiquidationPool.distributeAssets function lacks permission control
Vulnerability Details
The distributeAssets function has no permission controls, which allows anyone to call this function. This function should only be called by LiquidationPoolManager.
##Impact
An attacker can construct arbitrary parameters to call the distributeAssets function:
Transfer tokens from LiquidationPoolManager contract to LiquidationPool contract
Burn the EURO tokens of the LiquidationPool contract.
Tools Used
Recommendations
It is recommended to add permission control
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable
onlyManager {...}
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Assigned finding tags:
distributeAssets-issue
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.