lending-market/NoteInterest.sol Lack of access control in updateBaseRate() allowing baseRatePerYear to be changed by anyone

[code423n4]

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/b93e2867a64b420ce6ce317f01c7834a7b6b17ca/contracts/NoteInterest.sol#L118-L129

Vulnerability details

function updateBaseRate(uint newBaseRatePerYear) public {
    // check the current block number
    uint blockNumber = block.number;
    uint deltaBlocks = blockNumber.sub(lastUpdateBlock);

    if (deltaBlocks > updateFrequency) {
        // pass in a base rate per year
        baseRatePerYear = newBaseRatePerYear;
        lastUpdateBlock = blockNumber;
        emit NewInterestParams(baseRatePerYear);
    }
}

Recommendation

Add proper access control.

[ecmendenhall]

Duplicate of #22

[tkkwon1998]

Duplicate of issue #22

[GalloDaSballo]

Dup of #22