Part 2

**Summary **:

The updateAssetAllowance function allows the MarketMakingEngine to dynamically update the allowance for the underlying asset. This introduces a risk if the MarketMakingEngine is compromised.

**Vulnerability Details **:

• The updateAssetAllowance function sets the allowance for the underlying asset without additional safeguards.

• A malicious actor with control over the MarketMakingEngine could set an unlimited allowance and drain funds from the vault.

**Impact **:

• High risk of fund theft or misuse by a malicious actor with control over the MarketMakingEngine.

• Potential loss of all assets in the vault.

**Tools Used **:

• Manual code review.

• MythX for access control analysis.

**Recommendation **:

• Require admin approval for large allowance changes.

• Implement a pull-based model where the MarketMakingEngine requests tokens only when needed, reducing the risk of excessive allowances.