Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

DoS to liquidate borrower due to incorrect logical operator in onlyManagerOrOwner

Zealynx

Description

The StabilityPool::onlyManagerOrOwner modifier incorrectly uses the && operator instead of ||, which results in unintended access denial for authorized users. This logic flaw prevents either managers or the owner from executing protected functions if they are not both true.

modifier onlyManagerOrOwner() {
if (!managers[msg.sender] && msg.sender != owner()) revert UnauthorizedAccess();
_;
}

  • The modifier is intended to allow access if msg.sender is either a manager or the owner.

  • The current logic requires both conditions to be false to revert, which is contrary to the intended access control.

Impact

  • Access Denial: Authorized users (managers or the owner) may be unable to perform critical operations, leading to operational inefficiencies.

  • Security Risk: The incorrect logic could inadvertently allow unauthorized users to execute functions if access control is not properly enforced elsewhere.

  • Affected Parties: Managers and the owner who rely on executing privileged functions will be impacted by this access control flaw.

Recommended Mitigation

Option 1: Correct the Logical Operator

modifier onlyManagerOrOwner() {
- if (!managers[msg.sender] && msg.sender != owner()) revert UnauthorizedAccess();
+ if (!managers[msg.sender] || msg.sender != owner()) revert UnauthorizedAccess();
_;
}

Option 2: Rename Modifier for Clarity

  • If the logic is intended, rename the modifier to onlyManagerAndOwner to reflect the requirement for both roles to be true.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!