Submission Details
Severity:
`CurveVaultUpdated` event in LendingPool contract can be emitted if the same curve vault address is provided when calling `setCurveVault`
Summary
setCurveVault function is defined as follows:
function setCurveVault(address newVault) external onlyOwner {
require(newVault != address(0), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}
CurveVaultUpdated can be emitted when newVault = address(curveVault)which shouldn't be possible.
In comparison, setStabilityPool function ensures that newStabilityPool != stabilityPool, and setCurveVault should do the same.
Impact
The impact of this issue is low, as it leads to incorrect event emission.
Tools Used
Manual review
Recommendations
Make sure to check that newVault != address(CurveVault)in setCurveVault function:
function setCurveVault(address newVault) external onlyOwner {
require(newVault != address(0) && newVault != address(curveVault), "Invalid vault address");
address oldVault = address(curveVault);
curveVault = ICurveCrvUSDVault(newVault);
emit CurveVaultUpdated(oldVault, newVault);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.