The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Project parties can liquidate user assets by removing tokens from the pledged token list

acai

Summary

This is a problem of centralization risk. Project parties can liquidate user assets by removing tokens from the pledged token list.

Vulnerability Details

The SmartVaultV3 contract calculates the reserve of the vault contract through the euroCollateral function.

function euroCollateral() private view returns (uint256 euros) {
ITokenManager.Token[] memory acceptedTokens = getTokenManager().getAcceptedTokens();
for (uint256 i = 0; i < acceptedTokens.length; i++) {
ITokenManager.Token memory token = acceptedTokens[i];
euros += calculator.tokenToEurAvg(token, getAssetBalance(token.symbol, token.addr));
}
}

If the project party removes the tokens in acceptedTokens through the TokenManagerMock.removeAcceptedToken function, then he will be able to liquidate the funds of all vaults whose native tokens are insufficient to meet the mortgage rate.

function removeAcceptedToken(bytes32 _symbol) external onlyOwner {
require(_symbol != NATIVE, "err-native-required");
for (uint256 i = 0; i < acceptedTokens.length; i++) {
if (acceptedTokens[i].symbol == _symbol) {
acceptedTokens[i] = acceptedTokens[acceptedTokens.length - 1];
acceptedTokens.pop();
emit TokenRemoved(_symbol);
}
}
}

##Impact
The liquidation mechanism of this project is different from that of projects such as Compound. The liquidation of projects such as Compound is to give the liquidation profits to the user who initiated the liquidation (can be any user). The liquidation profit after the liquidation of this project is sent to the project party's contract address ISmartVaultManagerV3(manager).protocol(), so if the project party chooses to do evil, it can obtain all profits.

Tools Used

Recommendations

This hidden danger can be solved by setting an unmodifiable token list, but this will sacrifice flexibility and even introduce other problems. No better suggestions came to mind in a short period of time.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.