Submission Details
Severity:
Access Control issue.
Summary
No Access Control: the verification functions are publicly accessible with no access restrictions. Anyone can call these functions to update critical parameters:
function verifyPeriodByBlockHash(...) external returns (bool)
function verifyPeriodByStateRoot(...) external returns (bool)
Vulnerability Details
Impact
Tools Used
Recommendations
use access control.
Updates
Lead Judging Commences
0xnevi 5 months ago
Submission Judgement Published Reason: Out of scope
Assigned finding tags:
[invalid] finding-verify-functions-lack-access-control
Invalid, all state roots and proofs must be verified by the OOS `StateProofVerifier` inherited as `Verifier`, so there is no proof that a permisionless `verify`functions allow updating malicious prices
Prize pool breakdown
Total prize
14,723 OP
Eagles
1,472 OP
nSLOC
39437 OP / LOC
12,700
551
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.