Submission Details
Severity:
[M-1] the function `checkUpkeep` in `contracts\core\RebaseController.sol` should be called by a custom bot
Description: the function checkUpkeep in contracts\core\RebaseController.sol below should be called by a custom bot as stated by
@dev should be called by a custom bot (not CL automation)
/**
* @notice returns whether or not rewards should be updated due to a neagtive rebase,
* the strategies to update, and their total deposit change
* @dev should be called by a custom bot (not CL automation)
* @return upkeepNeeded whether or not rewards should be updated
* @return performData abi encoded list of strategy indexes to update and their total deposit change
**/
function checkUpkeep(bytes calldata) external view returns (bool, bytes memory) {
if (priorityPool.poolStatus() == IPriorityPool.PoolStatus.CLOSED) return (false, "0x");
address[] memory strategies = stakingPool.getStrategies();
bool[] memory strategiesToUpdate = new bool[]();
uint256 totalStrategiesToUpdate;
int256 totalDepositChange;
for (uint256 i = 0; i < strategies.length; ++i) {
int256 depositChange = IStrategy(strategies[i]).getDepositChange();
if (depositChange < 0) {
strategiesToUpdate[i] = true;
totalStrategiesToUpdate++;
totalDepositChange += depositChange;
}
}
if (totalStrategiesToUpdate != 0) {
uint256[] memory strategyIdxs = new uint256[]();
uint256 strategiesAdded;
for (uint256 i = 0; i < strategiesToUpdate.length; ++i) {
if (strategiesToUpdate[i]) {
strategyIdxs[strategiesAdded] = i;
strategiesAdded++;
}
}
return (true, abi.encode(strategyIdxs, uint256(-1 * totalDepositChange)));
}
return (false, "0x");
}
**Impact: **
Proof of Concept:
**Recommended Mitigation: ** The function should be restricted to onlyRebaseBotto avoid it been called through CL automation
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020
USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.