Submission Details
Severity:
Absence of Access Control Mechanism in `euroCollateral()` Function
Summary
Absence of Access Control Mechanisms in euroCollateral() Function
Vulnerability Details
Despite the euroCollateral() function's visibility being set to internal, it's still important to implement appropriate access control mechanisms within the contract itself to ensure that only authorized parts of the contract can call it.
Recommendations
A modifier can be created
modifier onlyVaultManager {
require(msg.sender == manager, INVALID_USER);
_;
}
and then utilised in the euroCollateral() function
function euroCollateral() private view onlyVaultManager returns (uint256 euros) {
ITokenManager.Token[] memory acceptedTokens = getTokenManager().getAcceptedTokens();
for (uint256 i = 0; i < acceptedTokens.length; i++) {
ITokenManager.Token memory token = acceptedTokens[i];
euros += calculator.tokenToEurAvg(token, getAssetBalance(token.symbol, token.addr));
}
}
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.