Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgraded Q -> M from #366 [1670366311052] #526

Closed
c4-judge opened this issue Dec 6, 2022 · 2 comments
Closed

Upgraded Q -> M from #366 [1670366311052] #526

c4-judge opened this issue Dec 6, 2022 · 2 comments
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value duplicate-33 satisfactory Finding meets requirement

Comments

@c4-judge
Copy link
Contributor

c4-judge commented Dec 6, 2022

Judge has assessed an item in Issue #366 as M risk. The relevant finding follows:

  1. Cannot cancel mutual consent
    https://github.com/debtdao/Line-of-Credit/blob/e8aa08b44f6132a5ed901f8daa231700c5afeb3a/contracts/utils/MutualConsent.sol#L11

Mutual consent works by using two TXs with the same msg.data. However, when first one call, there is no way to cancel it. First caller might send wrong msg.data or later caller change the mind in the midway.

Since it's not possible to cancel the process, later caller can take benefit and call it in the future.

Recommendation
Consider allowing to cancel the mutual consent process after some time interval.

@c4-judge c4-judge added the 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value label Dec 6, 2022
@c4-judge c4-judge closed this as completed Dec 6, 2022
@c4-judge
Copy link
Contributor Author

c4-judge commented Dec 6, 2022

dmvt marked the issue as duplicate of #33

@c4-judge
Copy link
Contributor Author

c4-judge commented Dec 6, 2022

dmvt marked the issue as satisfactory

@c4-judge c4-judge added the satisfactory Finding meets requirement label Dec 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value duplicate-33 satisfactory Finding meets requirement
Projects
None yet
Development

No branches or pull requests

1 participant