The Standard

Summary

The setOwner,setWethAddress, setSwapRouter2, setNFTMetadataGenerator, setSmartVaultDeployer, setProtocolAddress, setLiquidatorAddress functions lacks an address check, allowing any address to become the new owner without proper validation and so other functions that requires setting of a new address of new Swap router, NftMetadata, SmartVaultDeployer, ProtocolAddress, LiquidatorAddress. This poses a security vulnerability, as it could lead to unauthorized changes.

Vulnerability Details

The setOwner function does not validate the provided _newOwner address, allowing any address to be set as the new owner.

Without proper address validation, an attacker could call the setOwner function with a malicious address, leading to unauthorized ownership changes.

Impact

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L83
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L115
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L119
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L123
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L127
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L131
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L135

Tools Used

Manual review

Recommendations

It is essential to include address validation to ensure that only legitimate and authorized addresses can be set.