Moonwell

Vulnerability Details

The contract implementation of addresses.addAddress should specify the address is contract or EOA, by default it is EOA.

The correct implementation of addAddress is FPS shown here:

This shows the inconsistency of the implementation of the proposal as defined by the FPS framework.

Impact

Smart contract addresses are by default set as EOA if we don't specify the third bool variable _isContract which will lead of internal functional problem as EOA and smart contract don't work same.

Tools Used

Manual Review

Recommendations

Use latest version of FPS library and specify the _isContract bool while adding the addresses.