Skip to content

Latest commit

 

History

History
50 lines (32 loc) · 854 Bytes

023.md

File metadata and controls

50 lines (32 loc) · 854 Bytes

Tame Foggy Pony

Medium

Owner has privilege that is not according to the README

Summary

No response

Root Cause

Owner has more privileges than expected. According to README:

The owner can: Withdraw fees from the AutomationMaster Register oracles Set the min order size Set the max lending orders Register new sub keeper implementations

However, he can also cancel orders which is against the README:

    function adminCancelOrder(uint96 orderId) external onlyOwner {
        Order memory order = orders[orderId];
        require(_cancelOrder(order), "Order not active");
    }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

Allow owner actions that are according to his privileges