Submission Details
Severity:
Mismanaged Governance Parameters -LendingPool.sol
Summary
Owner-controlled parameters (e.g., liquidationThreshold) enable protocol abuse.
Vulnerability Details
Parameters like liquidationThreshold or liquidityBufferRatio are owner-controlled, allowing governance to arbitrarily alter liquidation logic.
Impact
A compromised owner could drain funds or block user interactions (e.g., by setting liquidationThreshold = 0).
Tools Used
Manual Code Review: Audit parameter-setting functions for access controls.
Recommendations
Use a timelock controller and multisig for parameter updates.
function setParameter(...) external onlyByTimelockOrOwner {
// ...
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.