Submission Details
Severity:
`createPool` Function should have a access modifier
Summary
In the Distribution.sol contract the createPool function has a onlyOwner access modifier but in DistributionV2.sol there is no onlyOwner access modifier for the createPool function.
Vulnerability Details
function createPool(IDistribution.Pool calldata pool_) public {
pools.push(pool_);
}
https://github.com/Cyfrin/2024-01-Morpheus/blob/76898177fbedcbbf4b78b513d9fa151bbf3388de/contracts/mock/DistributionV2.sol#L18
Impact
Anybody will be able to create their own pool, with their own custom parameters.
Tools Used
Manual Review
Recommendations
Add the onlyOwner modifier to the createPool function.
function createPool(IDistribution.Pool calldata pool_) public onlyOwner {
pools.push(pool_);
}
Updates
Lead Judging Commences
inallhonesty over 2 years ago
Submission Judgement Published Assigned finding tags:
`createPool` from DistributionV2.sol misses all the checks and access control available in Distribution.sol
inallhonesty over 2 years ago
Submission Judgement Published Assigned finding tags:
`createPool` from `DistributionV2.sol` misses all the checks and access control available in `Distribution.sol`
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421
USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.