Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Bahurum - Use of controller DNGMXVaultController for two separate contracts with different functions #25

Closed
github-actions bot opened this issue Jan 24, 2023 · 0 comments
Labels
Excluded Excluded by the judge without consulting the protocol or the senior Non-Reward This issue will not receive a payout

Comments

@github-actions
Copy link

Bahurum

informational

Use of controller DNGMXVaultController for two separate contracts with different functions

Summary

DNGMXVaultController must be deployed twice to control calls to two separate contracts withdrawPeriphery and depositPeriphery. While this poses no issues, it can be confusing.

Vulnerability Detail

DNGMXVaultController controls calls to the function depositToken(address,address,uint256) of depositPeriphery and to functions redeemToken(address,address,uint256) and withdrawToken(address,address,uint256) of withdrawPeriphery.
It must be deployed twice, one contract for each Perphery.
It can be confusing for someone looking at the chain to have functions for withdrawPeriphery in the controller of depositPeriphery and vice-versa.

Impact

Can be confusing to have a controller which contains checks for functions that are not present in the target integration.

Code Snippet

https://github.com/sherlock-audit/2023-01-sentiment/blob/main/controller-52/src/rage/DNGMXVaultController.sol#L15-L22

Tool used

Manual Review

Recommendation

Consider using two different contracts for controlling calls to withdrawPeriphery and to depositPeriphery, each containing only the checks to the functions to be called on the target integration.

@github-actions github-actions bot added the Excluded Excluded by the judge without consulting the protocol or the senior label Jan 24, 2023
@sherlock-admin sherlock-admin added the Non-Reward This issue will not receive a payout label Feb 2, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Excluded Excluded by the judge without consulting the protocol or the senior Non-Reward This issue will not receive a payout
Projects
None yet
Development

No branches or pull requests

1 participant