Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack Role Check in `applyRepairFundUpdate()`

maglov

Summary

The function applyRepairFundUpdate do not enforce proper role-based access control, allowing unauthorized users to update repair fund address. This could lead to funds being redirected to malicious addresses, resulting in potential financial loss.

Impact

  1. Loss of Funds: If an attacker changes the repair fund address, funds intended for system maintenance could be lost.

  2. Protocol Manipulation: Attackers could exploit this vulnerability to disrupt normal operations and governance.

Tools Used

Manual Review

Recommendations

Restrict Access: Use OpenZeppelin’s AccessControl or Ownable to ensure only authorized roles (e.g., ADMIN_ROLE) can call this function.

function applyRepairFundUpdate() external onlyRole(ADMIN_ROLE) {
if (pendingRepairFund.newAddress == address(0)) revert InvalidAddress();
if (block.timestamp < pendingRepairFund.effectiveTime) revert UnauthorizedCaller();
repairFund = pendingRepairFund.newAddress;
delete pendingRepairFund;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.