Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unprotected Administrative Privileges in LendingPool Contract - Single Point of Failure Risk

kineticsofweb3

Summary

The LendingPool contract implements basic ownership-based access control without multi-signature authentication or timelocks, creating a critical security vulnerability. This allows a single compromised admin key to execute sensitive protocol modifications without any oversight or delay, potentially leading to catastrophic consequences for user funds and protocol stability.

Vulnerability Details

  1. Vulnerability Type: Unprotected Administrative Privileges

  2. Severity: Critical

  3. Location: Multiple admin functions throughout the LendingPool contract

  4. Affected Functions:
    - setParameter for protocol parameters

  • setPrimeRateOracle for oracle management

  • setStabilityPool for pool configuration

  • setCurveVault for vault integration

Root Cause

  1. Basic Access Control Implementation - Uses simple onlyOwner modifier without additional security layers

  • No multi-signature requirements for critical operations

  • Absence of timelock mechanisms for sensitive changes

  1. Single Point of Failure - Complete reliance on single admin key

  • No distributed decision-making process

  • Immediate execution capability without oversight

Impact

  1. Protocol Security Risks - Potential for unauthorized protocol parameter modifications

  • Risk of compromised collateral ratios

  • Immediate execution of malicious changes

  1. User Fund Exposure - Direct risk to user deposits

  • Potential for manipulated lending terms

  • No protection against rapid protocol changes

Tools Used

  • Solidity compiler for contract analysis

  • Hardhat for testing and simulation

  • Ethers.js for transaction simulation

Proof of Concept

demonstrating the vulnerability using a Hardhat test that shows how quickly an admin can modify critical protocol parameters:

// test/UnprotectedAdmin.test.js
const { expect } = require('chai');
const { ethers } = require('hardhat');
​
describe('Unprotected Admin Privileges', function () {
let lendingPool;
let admin;
let user;
​
beforeEach(async function () {
[admin, user] = await ethers.getSigners();
// Deploy LendingPool contract
const LendingPool = await ethers.getContractFactory('LendingPool');
lendingPool = await LendingPool.deploy(
'0x...reserveAssetAddress',
'0x...rTokenAddress',
'0x...debtTokenAddress',
'0x...raacNFTAddress',
'0x...priceOracleAddress',
'100000000000000000' // Initial prime rate
);
});
​
it('Should demonstrate immediate admin parameter modification', async function () {
// Initial liquidation threshold
const initialThreshold = await lendingPool.liquidationThreshold();
console.log('Initial liquidation threshold:', initialThreshold.toString());
​
// Record current timestamp
const startTime = await ethers.provider.getBlockNumber();
const startTimestamp = (await ethers.provider.getBlock(startTime)).timestamp;
console.log('Start time:', startTimestamp);
​
// Admin modifies parameter immediately
await lendingPool.setParameter(0, 150_00); // Change threshold to 150%
​
// Get new threshold
const newThreshold = await lendingPool.liquidationThreshold();
console.log('New liquidation threshold:', newThreshold.toString());
​
// Get current timestamp
const endTime = await ethers.provider.getBlockNumber();
const endTimestamp = (await ethers.provider.getBlock(endTime)).timestamp;
console.log('End time:', endTimestamp);
​
// Calculate time difference
const timeDiff = endTimestamp - startTimestamp;
console.log('Time difference:', timeDiff.toString(), 'seconds');
​
// Verify the change occurred
expect(newThreshold).to.not.equal(initialThreshold);
});
});

run, this test will demonstrate how quickly an admin can modify critical protocol parameters without any protection mechanisms. The output show:

  1. Initial liquidation threshold value

  2. Timestamp before modification

  3. New threshold value after immediate modification

  4. Timestamp after modification

  5. Time difference between operations (typically near zero)

This PoC clearly demonstrates the vulnerability by showing how quickly critical protocol parameters can be modified by a single admin without any security checks or delays.

Recommendations

  1. Immediate Actions - Implement multi-signature authentication for critical functions

  • Add timelock mechanisms for parameter changes

  • Document and implement proper key management procedures

  1. Long-term Improvements

  • Implement role-based access control (RBAC)

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.