Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Guardian Update Functionality in `TadleFactory`

0xdarko

Summary

The TadleFactory contract lacks functionality to update the guardian address, potentially causing operational inflexibility.

Vulnerability Details

The guardian address is set in the constructor with no mechanism to change it afterwards. This design limits the contract's adaptability to organizational changes or security requirements.

Impact

If the guardian address needs to change (e.g., multisig update, key compromise):

  1. A new TadleFactory would need deployment.

  2. All core contracts interacting via relatedContracts mapping would require updates..

Tools Used

Foundry

Recommendations

  1. Implement a setGuardian function with appropriate access control:

+ error GuardianIsZero();
+ event GuardianChanged(address indexed newGuardian);
​
+ function setGuardian(address _newGuardian) external onlyGuardian {
+ if (_newGuardian == address(0)) {
+ revert GuardianIsZero();
+ }
+ address oldGuardian = guardian;
+ guardian = _newGuardian;
+ emit GuardianChanged(_newGuardian);
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!