TRSRY:getLoan() is permissioned, but no policy has permission to call it

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-olympus/blob/b5e139d732eb4c07102f149fb9426d356af617aa/src/modules/TRSRY.sol#L92

Vulnerability details

Impact

The getLoan() function in the TRSRY.sol contract is a way for users to withdraw approved loans from the protocol, which can be repaid with repayLoan().

No policies have permission to call this function, and it appears it was intended to be publicly callable, but it has the permissioned modifier, so it is functionally useless.

Without the getLoan() function, repayLoan() is functionally useless as well.

Proof of Concept

Checking the permissions set in each of the policies, there is no policy that has permission to call getLoan().

The permissioned modifier requires that the function is only called by policies that have been pre-approved.

/// @notice Modifier to restrict which policies have access to module functions.
modifier permissioned() {
    if (!kernel.modulePermissions(KEYCODE(), Policy(msg.sender), msg.sig))
        revert Module_PolicyNotPermitted(msg.sender);
    _;
}

As a result, this function cannot be called under any circumstances.

Tools Used

VS Code

Recommended Mitigation Steps

Remove the permissioned modifier from the getLoan() function.

[0xLienid]

The system is designed around the ability to add and remove policies in the future. The fact there is not a policy using this feature on launch does not preclude its future use and need for permissioning.

[0xean]

Downgrading to QA, sponsors may want to consider documenting that its intended for future use.