Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

DoS to liquidate borrower due to incorrect logical operator in onlyManagerOrOwner

Zealynx

Description

The StabilityPool::onlyManagerOrOwner modifier incorrectly uses the && operator instead of ||, which results in unintended access denial for authorized users. This logic flaw prevents either managers or the owner from executing protected functions if they are not both true.

modifier onlyManagerOrOwner() {
if (!managers[msg.sender] && msg.sender != owner()) revert UnauthorizedAccess();
_;
}

  • The modifier is intended to allow access if msg.sender is either a manager or the owner.

  • The current logic requires both conditions to be false to revert, which is contrary to the intended access control.

Impact

  • Access Denial: Authorized users (managers or the owner) may be unable to perform critical operations, leading to operational inefficiencies.

  • Security Risk: The incorrect logic could inadvertently allow unauthorized users to execute functions if access control is not properly enforced elsewhere.

  • Affected Parties: Managers and the owner who rely on executing privileged functions will be impacted by this access control flaw.

Recommended Mitigation

Option 1: Correct the Logical Operator

modifier onlyManagerOrOwner() {
- if (!managers[msg.sender] && msg.sender != owner()) revert UnauthorizedAccess();
+ if (!managers[msg.sender] || msg.sender != owner()) revert UnauthorizedAccess();
_;
}

Option 2: Rename Modifier for Clarity

  • If the logic is intended, rename the modifier to onlyManagerAndOwner to reflect the requirement for both roles to be true.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!