Submission Details
Severity:
Admin cant run the `setIntermediateValuesManually` function if the manager is approved to run it
Summary
If the admin wants to use the setIntermediateValuesManually function while the manager is aproved to use the function, the function revert on this line:
require(msg.sender == poolRuleSettings[_poolAddress].poolManager, "ONLYMANAGER");
Vulnerability Details
The following test fails and reverts "ONLYMANAGER".
POC
function testSetIntermediateValuesManuallyByOwnerWhenManagerIsApproved() public {
int256[] memory newMovingAverages = new int256[]();
newMovingAverages[0] = 0.0000000005e18;
newMovingAverages[1] = 0.0000000005e18;
newMovingAverages[2] = 0;
newMovingAverages[3] = 0;
int256[] memory newParameters = new int256[]();
newParameters[0] = 0.0000000005e18;
newParameters[1] = 0.0000000005e18;
newParameters[2] = 0;
newParameters[3] = 0;
mockPool.setPoolRegistry(24); // 16+8 ==> Both admin and manager are approved
vm.startPrank(owner);
updateWeightRunner.setApprovedActionsForPool(address(mockPool), 24); // 16+8
vm.stopPrank();
vm.startPrank(owner);
updateWeightRunner.setIntermediateValuesManually(address(mockPool), newMovingAverages, newParameters, 4);
}
Copy the test in UpdateWeightRunner.sol.
Impact
It becomes impossible for the admin to set intermediate weights manually if the pool manager has been given approval to handle that task.
Tools Used
Manual review
Recommendations
- if (poolRegistryEntry & MASK_POOL_OWNER_UPDATES > 0) {
- require(msg.sender == poolRuleSettings[_poolAddress].poolManager, "ONLYMANAGER");
- } else if (poolRegistryEntry & MASK_POOL_QUANTAMM_ADMIN_UPDATES > 0) {
- require(msg.sender == quantammAdmin, "ONLYADMIN");
+ if (msg.sender == poolRuleSettings[_poolAddress].poolManager) {
+ require(poolRegistryEntry & MASK_POOL_OWNER_UPDATES > 0, "ONLYMANAGER");
+ } else if (msg.sender == quantammAdmin) {
+ require(poolRegistryEntry & MASK_POOL_QUANTAMM_ADMIN_UPDATES > 0, "ONLYADMIN");
} else {
revert("No permission to set weight values");
}
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
invalid_manual_functions_cannot_be_called_by_admin_when_pool_owner_can
Design choice confirmed by the sponsor.
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017
OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.