-
Notifications
You must be signed in to change notification settings - Fork 1
Closed
Labels
2 (Med Risk)Assets not at direct risk, but function/availability of the protocol could be impacted or leak valueAssets not at direct risk, but function/availability of the protocol could be impacted or leak valueduplicate-13satisfactorysatisfies C4 submission criteria; eligible for awardssatisfies C4 submission criteria; eligible for awards
Description
Judge has assessed an item in Issue #19 as 2 risk. The relevant finding follows:
KFC-03L: Inexistent Duplicate Entry Prevention (Affected Lines: L175-L180)
The KUMAFeeCollector::changePayees function does not adequately sanitize the new payees, permitting duplicate entries to exist which will cause the contract to significantly misbehave as it would track the _totalShares incorrectly, and perform two payouts with the latest newShares[i] value. We advise the code to add a new if conditional which causes the code to fail if _payees.contains(newPayees[i]) evaluates to true.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
2 (Med Risk)Assets not at direct risk, but function/availability of the protocol could be impacted or leak valueAssets not at direct risk, but function/availability of the protocol could be impacted or leak valueduplicate-13satisfactorysatisfies C4 submission criteria; eligible for awardssatisfies C4 submission criteria; eligible for awards