Submission Details
Severity:
Unauthorized Access to Critical Functions
Summary
Some functions in the RootProxy and BranchManager contracts lack proper access control, allowing anyone to execute administrative actions like upgrading of branches, pausing/unpausing the contract, and modifying branch data.
Vulnerability Details
Affected Contracts & Function:
| Contract Name | Function Name | Issue |
|---|---|---|
RootProxy |
upgradeBranches() |
No onlyAdmin check, allowing unauthorized upgrades. |
RootProxy |
pause() |
No restriction, meaning anyone can pause the contract. |
RootProxy |
unpause() |
No restriction, meaning anyone can unpause the contract. |
BranchManager |
addBranch() |
No onlyAdmin, so anyone can add a branch (potential vulnerability). |
BranchManager |
removeBranch() |
No onlyAdmin, so anyone can remove a branch, possibly breaking functionality. |
Impact
The contracts **lack access control ** (onlyAdmin, AccessControl, or Ownable), making critical functions callable by anyone.
Tools Used
manual
Recommendations
strict access control should be enforced
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.