Require for setting an address of pool contract

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/main/paraspace-core/contracts/protocol/configuration/PoolAddressesProvider.sol#L75

Vulnerability details

Id parameter must not equal to the POOL constant. This prevents an attacker from overwriting the address of the pool contract, which could cause significant problems for the protocol.

Proof of Concept

Attacker calls setAddress and changes the address of the pool contract.
Now attacker owns the pool.

Recommended Mitigation Steps

Add require statement to setAdress() function similar to setAddressAsProxy():

require(id != POOL, Errors.INVALID_ADDRESSES_PROVIDER_ID);

[c4-judge]

dmvt marked the issue as duplicate of #54

[c4-judge]

dmvt marked the issue as unsatisfactory:
Insufficient quality

[c4-judge]

dmvt marked the issue as satisfactory

[c4-judge]

dmvt marked the issue as unsatisfactory:
Insufficient quality