The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Implement security mechanisms to reduce centralization risks

cosine

Summary

Protocol fees can be updated anytime without any time lock, governance process, or min max ranges. This allows the protocol to steal user funds. Basic security mechanisms should be implemented to reduce centralization risks.

Vulnerability Details

There are multiple fees implemented inside the protocol which are transferred to the protocol itself:

  • mintFeeRate: fee for taking a loan

  • burnFeeRate: fee for paying back a loan

  • swapFeeRate: fee for swapping tokens inside a vault

These fees can be updated anytime without time lock or governance and are not checked for min max values:

function setMintFeeRate(uint256 _rate) external onlyOwner {
mintFeeRate = _rate;
}
​
function setBurnFeeRate(uint256 _rate) external onlyOwner {
burnFeeRate = _rate;
}
​
function setSwapFeeRate(uint256 _rate) external onlyOwner {
swapFeeRate = _rate;
}

Therefore, it is possible to for example set the burn fee to 500% and therefore no user will be able to pay back the loan and all get liquidated. Or front run a mint or swap call and update the fee to steal user funds.

Other owner functions should also implement time locks to improve the trustlessness of the protocol:

function setWethAddress(address _weth) external onlyOwner() {
weth = _weth;
}
​
function setSwapRouter2(address _swapRouter) external onlyOwner() {
swapRouter2 = _swapRouter;
}
​
function setNFTMetadataGenerator(address _nftMetadataGenerator) external onlyOwner() {
nftMetadataGenerator = _nftMetadataGenerator;
}
​
function setSmartVaultDeployer(address _smartVaultDeployer) external onlyOwner() {
smartVaultDeployer = _smartVaultDeployer;
}
​
function setProtocolAddress(address _protocol) external onlyOwner() {
protocol = _protocol;
}
​
function setLiquidatorAddress(address _liquidator) external onlyOwner() {
liquidator = _liquidator;
}

Impact

The protocol is able to steal user funds by setting fees >= 100%.

Recommendations

Implement min max value checks and time locks for updating fees.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.