Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Access Control on Sensitive Functions

futhmah456

Summary

Functions like setFinalReferenceValue on line 85, transferFeeClaim on line 100, and createContingentPool on line 127 in IDIVA.sol contract are crucial to the contract’s operations but lack explicit access control. Without proper restrictions, unauthorized actors could exploit these functions.

Vulnerability Details

  • setFinalReferenceValue: This function allows setting a reference value for a pool, which is critical in determining payouts. If not restricted, malicious actors could manipulate final values, causing unintended losses.

  • transferFeeClaim: Transfers funds, meaning if this function is not properly restricted, it could result in unauthorized fee transfers.

  • createContingentPool: Creating a pool without restrictions could potentially lead to the creation of pools with invalid or malicious parameters.

Impact

Unauthorized actors could manipulate pool parameters, transfer funds, or interfere with pool creation, leading to financial loss or protocol disruption.

PoC for Lack of Access Control:

Actors:

  • Attacker: A malicious actor attempting to call sensitive functions without authorization.

  • Victim: The protocol or user who would bear the consequences of unauthorized function execution.

  • Protocol: The contract system managing pools, liquidity, and fees.

PoC Test Case:

import { expect } from "chai";
import { ethers } from "hardhat";
​
describe("Access Control Tests", function () {
let contract: any;
let attacker: any;
let victim: any;
​
beforeEach(async function () {
const Contract = await ethers.getContractFactory("YourContract");
contract = await Contract.deploy();
[attacker, victim] = await ethers.getSigners();
});
​
it("should prevent unauthorized users from calling setFinalReferenceValue", async function () {
const poolId = ethers.utils.formatBytes32String("pool123");
const finalReferenceValue = 1000000000000000000; // 1.0 in 18 decimals
await expect(
contract.connect(attacker).setFinalReferenceValue(poolId, finalReferenceValue, false)
).to.be.revertedWith("Ownable: caller is not the owner");
});
});
​

This test ensures that only the owner or authorized address can call setFinalReferenceValue, preventing unauthorized manipulation.

Tools Used

Manual code review, slither

Recommendations

  • Use onlyOwner or other role-based access control modifiers for sensitive functions.

  • Ensure only authorized addresses can execute crucial functions.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.