distributeAssets lacks important access control
Summary
The distributeAssets function in LiquidityPool lacks access control even though it is only supposed to be called by the LiquidationPoolManager.
Vulnerability Details
The function is supposed to only be called by the LiquidationPoolManager via the runLiquidation function.
The sponsor confirmed this, but also if this isn't the case, then anyone will be able to call it, passing any assets they want and any values for _collateralRate and _hundredPC which in turn affect the calculations of the rewards, so a malicious users could manipulate his rewards and then drain the pool.
Impact
Rewards manipulation and lost of funds.
Tools Used
Manual review
Recommendations
Add an access control modifier.
Lead Judging Commences
distributeAssets-issue
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.