Submission Details
Severity:
Lacking access control in CommunityVCS contract's performUpkeep() function
Summary
Lacking proper access control in CommunityVCS contract's performUpkeep() function can lead into corrupting system's states.
Audited scope:
2024-09-stakelink/contracts/linkStaking/CommunityVCS.sol
Vulnerability Details
Calling CommunityVCS contract's
performUpkeep()
// 2024-09-stakelink/contracts/linkStaking/CommunityVCS.sol
function performUpkeep(bytes calldata) external {
There is no explicit indication that above functions are protected by any access control.
Impact
Anyone can call this function directly to run internal processing, posing a significant security threat to the integrity and functionality of your system.
Recommended Mitigation
Apply onlyChainlink modifier (that checks caller address is from Chainlink nodes) to restrict access:
// 2024-09-stakelink/contracts/linkStaking/CommunityVCS.sol
function performUpkeep(bytes calldata) external onlyChainlink {
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020
USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.