Skip to content

Latest commit

 

History

History
39 lines (24 loc) · 1.9 KB

024.md

File metadata and controls

39 lines (24 loc) · 1.9 KB

Amusing Silver Tadpole

Medium

Lack of Access Control in setUserUseReserveAsCollateral and setUserEMode

Affected line of code: https://github.com/sherlock-audit/2025-01-aave-v3-3/blob/main/aave-v3-origin/src/contracts/protocol/pool/Pool.sol#L330-L345

https://github.com/sherlock-audit/2025-01-aave-v3-3/blob/main/aave-v3-origin/src/contracts/protocol/pool/Pool.sol#L770-L783

Severity: Medium

Summary: The functions setUserUseReserveAsCollateral and setUserEMode lack proper access control, which allows unauthorized users to alter another user's collateral status or eMode category. Additionally, while the contract reverts as expected, the revert behavior is inconsistent, leading to potential vulnerabilities under specific conditions.

Root Cause:

  • Missing Access Control: Both functions do not check if the caller is the user they are modifying, which can allow an attacker to change another user's settings.
  • EVM Revert Mismatch: The revert condition matches the expected logic, but the inconsistent behavior of the revert could lead to unexpected results, leaving room for potential exploitation.

Impact: Unauthorized users could change the collateral status or eMode settings of other users, leading to improper asset management. The inconsistent revert behavior may also allow attackers to bypass the protection in some cases.

PoC (Proof of Concept): Due to the revert mismatch, a full PoC cannot be provided. The revert works in most cases but may fail in others, making the behavior unreliable.

Mitigation: Add access control to both functions to ensure only the user involved can change their settings:

require(msg.sender == assetOwner, "Access denied: Only asset owner can change collateral status");
require(msg.sender == user, "Access denied: Only the user can change their eMode");

Ensure consistent revert behavior to avoid exploitation in edge cases.