Zaros Part 1

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/branches/LiquidationBranch.sol#L42-L86

Summary

Lack of access control in checkLiquidatableAccounts allows anyone to call this function, which can lead to abuse or unintended usage.

Vulnerability Details

This function can be called by any address, which might not be desirable as it could lead to abuse or excessive usage. Although it is a view function, restricting it to certain roles or addresses would enhance security.

Impact

• Potential Abuse: Unauthorized users might call this function excessively, leading to unnecessary resource consumption.

• Unintended Usage: Users without the proper role might misuse the function, leading to operational issues.

Tools Used

Manual

Recommendations

Add Access Control: Restrict the function to be called only by authorized addresses or roles.