Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Contracts Critical Function is called with different role instead of the original one.

akioniace

Summary

BoostController::setEmergencyShutdown should be called by the EMERGENCY_ADMIN instead it is called by the MANAGER_ROLE.

Vulnerability Details

BoostController::contructor establishes the roles to do specific execution of functions or other operations dependent on the role. SLOC#56-58.

// File: contracts/core/governance/boost/BoostController.sol
​
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(MANAGER_ROLE, msg.sender);
_grantRole(EMERGENCY_ADMIN, msg.sender);

Examining the Code, it is critical function on the contract that is used for the EmergencyPause or Instant Pause (Pause the Boost Contract) SLOC#353-360.

If we look at the function BoostController::setEmergencyShutdown SLOC#353 it is called by the MANAGER_ROLE instead of the EMERGENCY_ADMIN.

// File: contracts/core/governance/boost/BoostController.sol
​
function setEmergencyShutdown(bool paused) external onlyRole(MANAGER_ROLE) { // <@ POC here
if (paused) {
_pause();
} else {
_unpause();
}
emit EmergencyShutdown(msg.sender, paused);
}

Impact

Function Should be Called by the Role but the Role Used here is not Suitable for the execution of the function.

Tools Used

  • Manual Review

Recommended Mitigation

- function setEmergencyShutdown(bool paused) external onlyRole(MANAGER_ROLE) {
+ function setEmergencyShutdown(bool paused) external onlyRole(EMERGENCY_ADMIN) {
if (paused) {
_pause();
} else {
_unpause();
}
emit EmergencyShutdown(msg.sender, paused);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

akioniace Submitter
7 months ago
inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!