You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
Cannot add vault if it has been removed previously from the LMPVaultRegistry
Summary
Vaults are not removed from the vaultsByType set when they are rmoved from the LMPVault registry preventing them from being added to the registry again.
Vulnerability Detail
A vault cannot be added to the registry if it has been removed before due to the check in the addVault function that reverts if the vaultAddress is in the vaultByType becuase the vault address is not removed from vaultByType in removeVault.
The onlyLMP modifier of DestinationVault uses the LMPVaultRegistry to check if an LMPVault is registered. Removing the vault from the registry prevents priveleged interation with the destination vault's functions withdrawUnderlying and depositUnderlying. These functions are used when rebalancing the vault. Not being able to call these functions would result in not being able to rebalance the LMPVault through the rebalance functionality.
Impact
LMPVaults that were once removed but should be added are not able to rebalance.
sherlock-admin
changed the title
Flat Marigold Snake - Cannot add vault if it has been removed previously from the LMPVaultRegistry
dipp - Cannot add vault if it has been removed previously from the LMPVaultRegistry
Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
dipp
high
Cannot add vault if it has been removed previously from the LMPVaultRegistry
Summary
Vaults are not removed from the vaultsByType set when they are rmoved from the LMPVault registry preventing them from being added to the registry again.
Vulnerability Detail
A vault cannot be added to the registry if it has been removed before due to the check in the
addVault
function that reverts if the vaultAddress is in the vaultByType becuase the vault address is not removed from vaultByType inremoveVault
.The onlyLMP modifier of DestinationVault uses the LMPVaultRegistry to check if an LMPVault is registered. Removing the vault from the registry prevents priveleged interation with the destination vault's functions
withdrawUnderlying
anddepositUnderlying
. These functions are used when rebalancing the vault. Not being able to call these functions would result in not being able to rebalance the LMPVault through the rebalance functionality.Impact
LMPVaults that were once removed but should be added are not able to rebalance.
Code Snippet
LMPVaultRegistry.sol#L64-L82
LMPVaultRegistry.sol#L59
DestinationVault.sol#L59-L64
DestinationVault.sol#L204-L232
LMPDebt.sol#L321-L338
LMPDebt.sol#L390
Tool used
Manual Review
Recommendation
Remove the vault from the
vaultsByType
set.Duplicate of #674
The text was updated successfully, but these errors were encountered: