Ethena Labs - 0xG0P1's results

Enabling The Internet Bond

General Information

Platform: Code4rena

Start Date: 24/10/2023

Pot Size: $36,500 USDC

Total HM: 4

Participants: 147

Period: 6 days

Judge: 0xDjango

Id: 299

League: ETH

Ethena Labs

Findings Distribution

Researcher Performance

Rank: 147/147

Findings: 1

Award: $4.52

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L119-L128 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L106-L113

Vulnerability details

Impact

Admin cant remove or add someone to blacklist

Proof of Concept

This comment @notice Allows the owner (DEFAULT_ADMIN_ROLE) and blacklist managers to blacklist addresses. says that Admin should able to add or remove from blacklist but only blacklist manager can only can do it

Tools Used

Manual review

Allow Admin to remove/add to/from blacklist

Assessed type

Access Control

#0 - c4-pre-sort

2023-11-01T01:17:07Z

raymondfam marked the issue as low quality report

#1 - c4-pre-sort

2023-11-01T01:17:56Z

raymondfam marked the issue as duplicate of #136

#2 - c4-judge

2023-11-13T20:42:35Z

fatherGoose1 changed the severity to QA (Quality Assurance)

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter