Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Access Control in performUpkeep function

Caesar

Relevant GitHub Links

https://github.com/Cyfrin/2024-07-zaros/blob/main/src/external/chainlink/keepers/liquidation/LiquidationKeeper.sol#L100-L106

Summary

The performUpkeep function is protected by the onlyForwarder modifier, but if the forwarder address is compromised or improperly set, unauthorized users could trigger liquidations.

Vulnerability Details

Lack of Strict Access Control: The function relies on an external entity (forwarder) to control access, which might not be sufficient if the forwarder is not well-secured or if there is an issue in the onlyForwarder modifier implementation.

Impact

Unauthorized Liquidations: Malicious actors could liquidate accounts without proper authorization.

Tools Used

Manual

Recommendations

Strict Access Control: Ensure the onlyForwarder modifier is implemented correctly and consider adding additional layers of access control.

+ modifier onlyAuthorized() {
+ require(msg.sender == forwarder || msg.sender == owner(), "Not authorized");
+ _;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.