Submission Details
Severity:
`HealthToken` will be bricked if `HealthToken::setMarketAndVotingAddress` is never called by the Owner
Summary
If the Owner of the HealthToken smart contract never calls HealthToken::setMarketAndVotingAddress health tokens will never be distributed
Vulnerability Details & Impact
The only addresses that are allowed to call distributeHealthToken are the MartenitsaMarketplace and MartenitsaVoting and this is the only way HealthTokens are minted to users or producers.
function distributeHealthToken(address to, uint256 amount) external {
require(msg.sender == address(_martenitsaMarketplace) || msg.sender == address(_martenitsaVoting), "Unable to call this function");
uint256 amountToMint = amount * 10 ** 18;
_mint(to, amountToMint);
}
If this function is never called the contract will never distribute HealthTokens and major functionalities of the Baba Marta system will be broken.
Tools Used
Manual Review
Recommendations
Set these addresses in the constructor.
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.