Part 2

Summary

In the fulfillSwap function, the engine address is provided as an external input parameter. This engine address is used to retrieve the corresponding usdToken from the MarketMakingEngineConfiguration. If the usdTokenOfEngine mapping is mutable and not properly restricted, a malicious keeper could pass an arbitrary engine address that points to a malicious contract implementing the UsdToken interface. This could allow the attacker to burn unauthorized tokens, execute reentrancy attacks, or steal funds by redirecting token transfers to their own accounts.

Impacted code:

I've rated this as MEDIUM because the exploit equires the ability to submit transactions with arbitrary engine addresses.

Recommendations

Ensure the `engine` parameter is validated against a whitelist of authorized engine addresses before using it to fetch the `usdToken`. Additionally, consider implementing further checks or using a more secure method to associate engines with their tokens to prevent arbitrary manipulation.

For example: implement a whitelist of authorized engine addresses and validate the engine parameter against this list before using it.