Submission Details
Severity:
State variables not capped at reasonable values
Summary
Consider adding minimum/maximum value checks to ensure that the state variables below can never be used to excessively harm users, including via griefing.
Vulnerability Details
This will be useful in case the owner gets compromised and the malicious owner wants to grief users via fees.
In LiquidationPoolManager:
function setPoolFeePercentage(uint32 _poolFeePercentage) external onlyOwner {
poolFeePercentage = _poolFeePercentage;
}
In SmartVaultManagerV5:
function setMintFeeRate(uint256 _rate) external onlyOwner {
mintFeeRate = _rate;
}
function setBurnFeeRate(uint256 _rate) external onlyOwner {
burnFeeRate = _rate;
}
function setSwapFeeRate(uint256 _rate) external onlyOwner {
swapFeeRate = _rate;
}
Impact
Users can get griefed if the owner gets compromised.
Tools Used
Manual review
Recommendations
Consider adding minimum/maximum value checks to this state variables.
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.