Core Contracts

Summary

The FeeCollector::setTreasury and FeeCollector::setRepairFund functions allow setting a pending treasury and repair fund update. However, once a pending update is set, it cannot be revoked or canceled, leading to potential security risks if an incorrect or malicious address is configured.

Vulnerability Details

The protocol lacks a mechanism to revoke or cancel a pending treasury or repair fund update once it has been set. If an incorrect or malicious address is configured, the admin can only change it to another address, but cannot reset it to address(0).

Affected Code in FeeCollector

Once an update is scheduled, it cannot be canceled. The only way to change the pending update is to override it with another address, preventing the admin from setting it back to address(0).

Setting the Pending Update

The same issue applies to setTreasury, where an admin can only set a new treasury address but cannot revoke an existing pending update.

Steps to Reproduce

1. Admin calls setRepairFund(newAddress), scheduling an update.

2. Admin realizes that the address is incorrect or potentially malicious.

3. Admin attempts to revoke the pending update by setting it to address(0), but this is not allowed.

4. The only available option is to set another valid address, but there is no way to prevent the update entirely.

Impact

• Irrevocable Configuration: Once a pending update is scheduled, it cannot be revoked.

• Potential Security Risks: If a malicious address is mistakenly set, the admin has no way to cancel it entirely.

Tools Used

Manual Review

Recommendations

Introduce a Revocation Mechanism